React2Shell

React2Shell /$$$$$$$ /$$ /$$$$$$ /$$$$$$ /$$ /$$ /$$ | $$ $$ | $$ /$$ $$ /$$ $$| $$ | $$| $$ | $$ \ $$ /$$$$$$ /$$$$$$ /$$$$$$$ /$$$$$$ |/ \ $$| $$ /| $$$$$$$ /$$$$$$ | $$| $$ | $$$$$$$/ /$$ $$ | $$ /$$/| $$/ /$$$$$$/| $$$$$$ | $$ $$ /$$ $$| $$| $$ | $$ $$| $$$$$$$$ /$$$$$$$| $$ | $$ /$$/ \ $$| $...

CVE-2017-17215

CVE-2017-17215 Usage: CVE-2017-12149.py http://targetip:37215/ I am so poor that cant afford to but a HUAWEI router XD so it is not tested on any machine but the exp technically should be working I found this report...

Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions

Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code execution, meaning an attacker could run code ...

CVE-2026-27966

CVE-2026-27966 — Langflow Remote Code Execution Scanner Pre-Auth Route Injection + Vertex Injection → Python Code Execution Overview CVE-2026-27966 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Langflow versions prior to 1.8.0. The vulnerability stems...

CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 — Next.js Middleware / RSC Bypass Analysis The author assumes no liability for misuse or damage caused by this research Provided strictly for educational and defensive purposes Description This repository contains a small laboratory and Proof-of-Concept analysis fo...

CVE-2026-34197

CVE-2026-34197 ActiveMQ Classic Lab This repository contains a local lab for studying CVE-2026-34197 in Apache ActiveMQ Classic and for comparing a vulnerable instance against a patched build. The repository is organized to support two goals: Reproduce the issue in a tightly controlled, isolated...

Security update for php8

This update for php8 fixes the following issue: CVE-2026-109618,CVE-2026-109619: memory corruption leading to RCE bsc1286027. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor Unauthenticated RCE via INLINE GraalVM Evaluator Conductor OSS / Orkes3.21.21 … before 3.30.2 evaluates user-supplied JavaScript in INLINE and LAMBDA / DOWHILE / SWITCH tasks with a GraalVM context built with full host access HostAccess.ALL. The script reflects up to...

CVE-2026-46454

camel-cometd Inbound Bayeux Header Injection Reproducer CVE-2026-46454 This project demonstrates a message-header injection in Apache Camel's camel-cometd component, tracked as CVE-2026-46454. The component maps inbound Bayeux CometD message headers into the Camel Exchange without...

CVE-2025-69212

CVE-2025-69212 Description OpenSTAManager is a management software solution for technical assistance, electronic invoicing, and accounting. The versions =2.9.8 are vulnerable to an authenticated remote code execution vulnerability. An attacker can exploit this issue by uploading a specially craft...

CVE-2026-24061

CVE-2026-24061 GNU inetutils-telnetd - Remote Authentication Bypass A security research tool for exploiting CVE-2026-24061, a critical remote authentication bypass vulnerability in GNU inetutils-telnetd that allows instant root shell access without authentication. Table of Contents Vulnerability...

CVE-2026-38751-OpenSTAManager-Arbitrary-File-Upload-PoC

CVE-2026-38751 – OpenSTAManager Arbitrary File Upload PoC This repository contains a proof-of-concept PoC exploit for CVE-2026-38751, affecting OpenSTAManager ≤ 2.10. The vulnerability allows an authenticated attacker to upload a malicious module via the module update functionality, leading to...

Room-Walkthrough-Billing

🧠 Room Walkthrough: Billing Written by: Aditya Bhatt | Open Source Contributor 📦 Overview In this walkthrough, we go full force into Billing Room , showcasing a vulnerable MagnusBilling instance, a juicy unauth RCE CVE-2023-30258, and a fail2ban sudo misconfig that screams “root me.” This room...

CVE-2026-56121-Feast-Unauth-RCE

CVE-2026-56121 — Feast Unauthenticated RCE via gRPC Registry Deserialization The Feast 0.63.0 registry gRPC server dill.loads the user-defined function of an OnDemandFeatureView as soon as a spec arrives — before any authorization check. The shipped config is auth: noauth, so any client that can...

CVE-2022-25476

CVE-2022-25476 ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual environment python...

cve-2024-43425

CVE-2024-43425 Firmware info: Application name: Moodle Build version: moodle-4.4.1 Affected versions: 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 and earlier unsupported versions Download link: moodle-4.4.1 Description and Impact Attackers with permission to create or modify questions...

CVE-2026-22241

CVE-2026-22241 Lab Environment for CVE-2026-22241 Vulnerability Description: Vulnerability: Unrestricted Upload of File with Dangerous Type. Impact: Remote Code Execution RCE. Description: This flaw allows an attacker with administrative privileges to upload a malicious PHP file Web Shell, leadin...

CVE-RUBY

cve-id Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example...

CVE-2025-8110

CVE-2025-8110 Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. How does this detection method work? Extracts the Gogs version from the footer of /user/login via regex Gogs Version: X.X.X and flags instances running version 0.13.3 or earlier as...

CVE-2026-76071

CVE-2026-76071: Unauthenticated Pre-Auth Stack Buffer Overflow via sscanf %^, in skkset.cgi ipFilterList Handler in Netis NC63 Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76071 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 AC1200 Wireless Dual Band Gigabit MU-MIMO Rout...