CVE-2025-3248

CVE-2025-3248 Remote Code Execution using vulnerable API endpoint Proof of Concept. Info: ⚠️ Use this at your own risk! ❓ Added option to reverse shell. ✅ Auto retry if validatecode is off. Showcase Usage python CVE-2025-3248.py / python3 CVE-2025-3248.py Footprint By using this tool, you agree...

TimeInjector

TimeInjector Time injector is a CVE-2018-14714 exploitation script in bash To tell if the target is vulnerable, the script works by first checking if the target is accessible and if it can establish a login session. After that, it checks for the existence of specific pages and performs a time-bas...

CVE-2022-1388-PocExp

CVE-2022-1388-PocExp CVE-2022-1388-PocExp,新增了多线程 Usgae Usage Single URL：python3 CVE-2022-1388.py -u url Usage, List of URLS：python3 CVE-2022-1388.py -f url.txt Usage, Exec：python3 CVE-2022-1388.py -u url -c command Usage, ExecFile：python3 CVE-2022-1388.py -f url.txt -c id...

CVE-2019-12185

CVE-2019-12185 eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be...

l4j-tp1

log4shell true positive This is a simple web project with a log4shell vulnerability. The project defines a simple scabench.HelloWorldService get service returning a plain text string hello world. The service does not expect parameters, and if parameters are encountered, an error is logged. The...

CVE-2025-49113-Roundcube-RCE-PHP

CVE-2025-49113-Roundcube-RCE-PHP Roundcube Webmail versions 1.5.0 through 1.6.10 This is a rewritten exploit to work with PHP. Usage php CVE-2025-49113.php...

OgnlContentTypeRejectorValve

OgnlContentTypeRejectorValva This is Valve for Tomcat7 to block Struts 2 Remote Code Execution vulnerability CVE-2017-5638...

CVE-2025-42944

CVE-2025-42944 Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution,...

CVE-2023-38831-RaRCE

RaRCE, Exploit generator for CVE-2023-38831 This is an easy to install and easy to use, versatile exploit generator for CVE-2023-38831, a vulnerability that affects WinRAR versions before 6.23. RARLabs WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a...

CVE-2021-34371

CVE-2021-34371 python exploit - Neo4j 3.4.18 - RMI based Remote Code Execution RCE...

CVE-2014-7205

Bassmaster NodeJS Plugin RCE PoC bassmaster-rce.py: A Python script to exploit CVE-2014-7205. nodeshell.py: A Python module to generate a reverse shell for NodeJS !!Only use against servers on which you have permission to test Summary CVE-2014-7205 is a Remote Code Execution vulnerability in...

Mysql_CVE-2024-27766

Exploit Reproduction Guide affected product version MariaDB 11.1 This guide provides step-by-step instructions to reproduce a User-Defined Function UDF attack on a database system. Please note that this exploit may work on some systems, but it might not function correctly on 64-bit architectures ...

CVE-2014-6271

CVE-2014-6271 A vulnerability known as "ShellShock" exists in GNU Bash through 4.3 due to how it processes trailing strings in the values of environment variables after function definitions. This vulnerability enables remote attackers to execute arbitrary code by crafting the environment in certa...

CVE-2018-0802

CVE-2018-0802 CVE-2018-08022: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0802 MITRE CVE-2018-0802: https://vulners.com/cve/CVE-2018-0802 0patch exploitation and patch video: https://www.youtube.com/watch?v=XU-U4K270Z4 Qihoo 360 blog post...

CVE-2026-1953

CVE-2026-1953 | Stored XSS — Nukegraphic CMS v3.1.2 Overview A Stored Cross-Site Scripting XSS vulnerability exists in Nukegraphic CMS v3.1.2. The issue allows an authenticated user to inject malicious JavaScript into the profile name field, which is stored in the backend database and executed...

CVE-2020-11651

CVE-2020-11651 PoC for CVE-2020-11651 Requires Python3 tested on 3.8 python3.8 -m pip install pyzmq msgpack ⇒ python3.8 poc.py -h usage: poc.py -h -p PORT -c CMD -k -m -r READ -w WRITE -f FILE server server ... Exploit CVE-2020-11651 positional arguments: server Target Server IP or Host optional...

CVE-2025-27590

CVE-2025-27590 - PoC Exploit Command Injection via Multipart Form Upload 📌 Description This is a Proof-of-Concept PoC exploit for CVE-2025-27590 , a command injection vulnerability affecting web applications that process multipart file uploads without proper sanitization. The vulnerability allows...

CVE-2024-50848

CVE-2024-50848: XXE in the WorldServer v11.8.2 An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 might lead to access sensitive system information and execute arbitrary commands via supplying a crafted .tmx file. To...

CVE-2025-49113

CVE-2025-49113 Roundcube Exploit A Python exploit for CVE-2025-49113, targeting a vulnerability in Roundcube webmail that allows remote code execution through PHP object deserialization. Overview This exploit leverages a deserialization vulnerability in Roundcube's file upload functionality. It...

cve-2018-7600-drupalgeddon2-lab

CVE-2018-7600 Drupalgeddon2 Vulnerability Lab Educational lab demonstrating exploitation of CVE-2018-7600 Drupalgeddon2 using a vulnerable Drupal 7.56 environment deployed with Docker. This project simulates a real-world vulnerability assessment workflow, including: Vulnerable environment setup...