CVE-2025-12189

Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents CSRF Attack function exploit const form = document.createElement'form'; form.action = 'http://TARGETSITE.COM/wp-admin/admin-ajax.php'; form.method = 'POST'; form.enctype = 'multipart/form-data';...

CVE-2025-68613-Python-Exploit

CVE-2025-68613: n8n Workflow Expression RCE Proof of Concept PoC exploit for a critical Remote Code Execution vulnerability in the n8n workflow automation platform. Description The vulnerability exists in the n8n expression evaluation system. User-supplied expressions are not properly sandboxed,...

Exploit-PoC-para-CVE-2024-30085

🚨 Exploit PoC for CVE-2024-30085 Proof of Concept exploit for the CVE-2024-30085 privilege escalation vulnerability. For educational and security research purposes only. ⚠️ Legal Warning FOR EDUCATIONAL USE ONLY ✅ Authorized security research ✅ Controlled laboratories ✅ Cybersecurity education ❌...

CS4277-CVE-Path-Traversal-Apache-HTTP-Server

CS4277-CVE-Path-Traversal-Apache-HTTP-Server Team Members: Emily Nguyen, Jonathan Kim, Joon Jang Project Topic Selection: Project 1: Recreate and Exploit a Real-World CVE: Path Traversal CVE-2021-41773 in the Apache HTTP Server. Project Goal: We hope to reproduce CVE-2021-41773 to deepen our...

CVE-2026-114635

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client...

CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client...

CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client...

CVE-2026-114635

Traefik versions prior to v2.11.58 and v3.7.14 are vulnerable to an authentication bypass within the SNI check. The vulnerability occurs because the check is skipped when the request TLS state is nil. On Go 1.27 builds, unauthenticated clients can bypass certificate requirements by sending HTTP/2...

EUVD-2026-107890

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds to reach routers requiring client...

CVE-2025-55182

CVE-2025-55182 Scanner A proof-of-concept scanner for CVE-2025-55182 , a critical unauthenticated Remote Code Execution RCE vulnerability in React Server Components RSC. Overview On December 3, 2025, a critical vulnerability was disclosed affecting React 19.x and Next.js applications using React...

CVE-2026-3844-Lab

CVE-2026-3844 — Breeze Cache Unauthenticated Arbitrary File Upload to RCE Lab Local-only Docker lab for reproducing and comparing CVE-2026-3844 behavior in the WordPress Breeze Cache plugin. This repository demonstrates the vulnerable behavior in Breeze Cache 2.4.4 and compares it with the patche...

-CVE-2025-59528-PoC

CVE-2025-59528-PoC FOR EDUCATIONAL PURPOSES ONLY A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool, that is also part of an HTB seasonal challenge, on which I tested it btw. If it's not working, make sure the comman...

teatime

=========================================== Teatime - A Blockchain RPC Attack Framework .. image:: https://img.shields.io/pypi/v/teatime.svg :target: https://pypi.python.org/pypi/teatime .. image:: https://img.shields.io/travis/dmuhs/teatime.svg :target: https://travis-ci.com/dmuhs/teatime...

CVE-2025-55182-Scanner

CVE‑2025‑55182 – Next.js RSC Deserialization RCE Scanner This tool checks whether a target is vulnerable to CVE‑2025‑55182 , a Remote Code Execution bug caused by unsafe handling of RSC React Server Components model payloads inside Next.js. The vulnerability chains Prototype Pollution →...

external_expact_AOSP10_r33_CVE-2022-25315

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

CrowdFMS

Copyright C 2013 CrowdStrike, Inc. This file is subject to the terms and conditions of the BSD License. See the file LICENSE in the main directory for details CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This...

CVE-2025-47812

🚀 Wing FTP Exploit - CVE-2025-47812 Enhanced exploit for Wing FTP Server CVE-2025-47812 - Unauthenticated Remote Code Execution RCE 🔧 Installation Clone this repository and enter the directory: git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 pip install -r...

MongoBLEED---CVE-2025-14847-POC-

MongoBLEED---CVE-2025-14847-POC- This repo contains my python script version of CVE-2025-14847 MongoBleed Description The script simulates a malicious request by sending a forged decompression size field. If the server is vulnerable, it will return adjacent data from the heap memory. Prerequisite...

CVE-2025-55182-poc-tool

CVE-2025-55182-poc-tool A powerful exploit tool for detecting and exploiting CVE-2025-55182 vulnerability in Next.js React Server Components. This tool allows remote command execution RCE in vulnerable Next.js applications with built-in WAF bypass capabilities. Overview CVE-2025-55182 is a critic...

DarkSword_analysis

DarkSwordanalysis Static analysis of the DarkSword iOS WebKit exploit chain — delivery, staging, and CVE breakdown CVE-2025-31277, CVE-2025-43529 I'm a freshman Information Systems student working through this exploit chain as I build my reverse engineering and malware analysis skills. I'll updat...