1236 matches found
wp2shell-poc
wp2shell 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN WordPress Core Pre-Authentication RCE Chain wp2shell is a security research Proof-of-Concept demonstrating a pre-authentication vulnerability chain in...
CVE-2025-54322
CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE Scanner A multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution vulnerability in XSpeeder SXZOS firmware affecting 70,000+ hosts globally. 📋 Table of Contents About the Vulnerability Features Installation Usa...
cve-2026-42945
CVE-2026-42945 — NGINX Rewrite Heap Overrun: Analysis, DoS & Credited RCE Port Security research on CVE-2026-42945 CVSS 4.0 9.2 CRITICAL: a heap buffer overrun in NGINX's script engine where a rewrite with arguments in the replacement e.g. rewrite ^. /new?c=1; leaves the engine's isargs flag set...
CVE-2023-38646-PoC
CVE-2023-38646 - Metabase Pre-auth RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1,...
CVE-2019-11510-poc
CVE-2019-11510-poc Pulse Secure SSL VPN pre-auth file reading Reference 1. https://hackerone.com/reports/591295 2. https://github.com/projectzeroindia/CVE-2019-11510/blob/master/CVE-2019-11510.sh 3...
CVE-2026-29000-PoC-Exploit
CVE-2026-29000 - pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 - One-Click Admin Forge via JWT alg:none + JWE Encryption Overview This exploit weaponizes CVE-2026-29000 , a critical CVSS 10.0 vulnerability in the pac4j-jwt library. By extracting the server's public JWKS key and forging a...
EXPLOIT-CVE-2026-26216
CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHSA-5882-5rx9-xgxp CVSS 10.0 · pre-auth RCE · CWE-94 Code Injection Unauthenticated remote code execution on the Crawl4AI Docker server field. This code is executed with exec inside a "homemade sandbox" — a restricted builtins dictionary...
Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)
Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...
D-Tale <= 3.16.0 - Pre-Auth RCE via Pandas Query Injection
D-Tale prior to version 3.16.1 contains a remote code execution caused by the update-settings endpoint allowing updates to enablecustomfilters, letting attackers run malicious code on the server, exploit requires hosting D-Tale publicly. id: CVE-2024-55890 info: name: D-Tale = 3.16.0 - Pre-Auth R...
Pre-Auth Takeover of Build Pipelines in GoCD
GoCD contains a critical information disclosure vulnerability whose exploitation allows unauthenticated attackers to leak configuration information including build secrets and encryption keys. id: CVE-2021-43287 info: name: Pre-Auth Takeover of Build Pipelines in GoCD author: dhiyaneshDk severity...
N-able N-central <2026.3.1.14 - Pre-Authentication Remote Code Execution
N-able N-central versions before 2026.3.1.14 are vulnerable to pre-authentication remote code execution via static code injection CWE-96. An unauthenticated attacker with network access to the N-central management interface can execute arbitrary code on the server, potentially compromising every...
Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)
The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. id: CVE-2020-29453 info: name: Jira Server Pre-Auth - Arbitrary File...
php2shell-poc
php2shell CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit Exploits · Detection · Lab · Writeup Five independent RCE chains exploiting PHP's session.uploadprogress and the Zend engine's OOM bailout. 14 years of vulnerable code — PHP 5.4.0 2012 through 8.5.11...
watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553
CVE-2025-40552 and CVE-2025-40553 SolarWinds Web Help Desk Pre-Auth RCE Chain SolarWinds Web Help Desk Pre-Auth RCE Chain Detection Artifact Generator Tool Description This Detection Artifact Generator verifies if SolarWinds Web Help Desk instance is vulnerable to CVE-2025-40552 and CVE-2025-4055...
cohort-htb
Cohort — HTB writeup & exploit chain Machine Cohort HackTheBox. Full kill chain: 1. SSRF in the Flask API /api/validate → internal vhost discovery 2. Pre-auth RCE in Marimo 0.20.4 WebSocket terminal CVE-2026-39987 → shell as marimo 3. Privilege escalation via PackageKit 1.2.8 D-Bus TOCTOU...
BlueKeep
Bluekeep PoC This repo contains research concerning CVE-2019-0708. Bluekeep or CVE-2019-0708 is an RCE exploit that effects the following versions of Windows systems: Windows 2003 Windows XP Windows Vista Windows 7 Windows Server 2008 Windows Server 2008 R2 The vulnerability occurs during...
Wp2Shell
wp2shell Pre-Authentication Remote Code Execution in WordPress Core. CVE-2026-60137 SQL Injection in WPQuery chained with CVE-2026-63030 REST API Batch Route Confusion. For educational and authorised security research purposes only. Affected Versions WordPress 6.9.0 through 6.9.4 and 7.0.0 throug...
CVE-2026-62911
CVE-2026-62911 Pre-auth RCE on Microsoft Exchange Server. No credentials needed. Orange Tsai DEVCORE used this at Pwn2Own Berlin 2026 as part of a 3-bug chain. $200,000 prize, full SYSTEM takeover. What it does Exchange exposes MailboxReplicationProxyService MRSProxy on two paths. One of them sit...
CVE-2026-21643
CVE-2026-21643 Checker & Nuclei Template This repository contains detection tools for CVE-2026-21643 , a pre-authentication SQL Injection vulnerability in FortiClient EMS 7.4.4. The vulnerability exists in the /api/v1/initconsts and /api/v1/auth/signin endpoints, where the Site HTTP header is...