CVE-2026-60004-POC

CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9.8 ┌──────────────────────────────────────────────────────────────┐ │ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 CRIT │ │ diffpatch → git hook injection │ v1.17–1.27.0 affected │...

CVE-2023-38646-PoC

CVE-2023-38646 - Metabase Pre-auth RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1,...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework-Toolkit Oracle WebLogic Server — SAML Authentication Bypass → Admin Takeover Exploit Framework & Mass Scanner For authorized security testing only. Legal Disclaimer & Responsible Use This tool is provided for educational and...

CVE-2026-62911

CVE-2026-62911 Pre-auth RCE on Microsoft Exchange Server. No credentials needed. Orange Tsai DEVCORE used this at Pwn2Own Berlin 2026 as part of a 3-bug chain. $200,000 prize, full SYSTEM takeover. What it does Exchange exposes MailboxReplicationProxyService MRSProxy on two paths. One of them sit...

watchTowr-vs-SysAid-PreAuth-RCE-Chain

SysAid PreAuth RCE Chain PoC PoC for SysAid PreAuth RCE Chain CVE-2025-2775, CVE-2025-2776, CVE-2025-2777, CVE-2025-2778 See our blog post for technical details https://github.com/user-attachments/assets/03245fab-915d-43b6-8e91-f0a18251af49 PoC in Action python...

cpanel-sessionscribe

SessionScribe - CVE-2026-41940 Critical unauthenticated RCE in cPanel & WHM. Four HTTP requests forge a root session via CRLF injection into the password field of a preauth session. No auth, no preconditions, every supported tier affected. Disclosed 2026-04-28 by Sina Kheirkhah / watchTowr Labs...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

Silent-Call

Silent;Call Pre-authentication remote root on Cisco Unified Communications Manager 15.x Three HTTP requests. Zero credentials. Root access. Every call is now yours. Kill Chain Step| Component| Description ---|---|--- 1| Spoofhack| X-Forwarded-For header spoofing bypasses localhost restriction on...

CVE-2022-26134

CVE-2022-26134 A pre-authenticated RCE vulnerability in Atlassian Confluence Summary of the CVE In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data...

CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this...

CVE-2024-50629_50631

CVE-2024-5062950631 Pre-auth RCE N-day exploitation of Synology BeeStation. Detail: https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron https://github.com/user-attachments/assets/8e2ef59c-4f60-4308-8cd4-6d7ce0ba72e1 $ python3 poc.py 192.168.88.248 192.168.88.254 LISTENER listeni...

CVE-2021-26084

Confluence Server Webwork Pre-Auth OGNL Injection CVE-2021-26084 Confluence is a web-based corporate wiki developed by Australian software company Atlassian. An OGNL injection vulnerability exists that allows an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data...

CVE-2025-32432

CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Authentication Remote Code Execution in Craft CMS Affected: Craft CMS 3.x, 4.x, and 5.x up to 5.6.16 Info: This exploit is tested against HackTheBox Orion machine Overview This repository contains a proof-of-concept exploit for CVE-2025-32432...

vbulletin-exploits

vbulletin-exploits Exploits targeting vBulletin. CVE-2023-25135: Pre-authentication RCE See: https://www.ambionics.io/blog/vbulletin-unserializable-but-unreachable ./vbulletin-rce-cve-2023-25135.py --help Usage: vbulletin-rce-cve-2023-25135.py -h -p PROXY url command Exploit for CVE-2023-25135:...

cve-2019-7192-check

QNAP Pre-Auth Root RCE CVE-2019-7192 CVE-2019-7195 Checker Usage: pip install requests ./CheckerforQNAPRCEcve2019719295.py /path/to/ip-port.txt Example file input: 1.2.3.4 8080 2.3.4.5 443 This tool takes a list of QNAP NASes' IPs and ports, and it tells if each device is vulnerable to the...

CVE-2023-38646

CVE-2023-38646 - Metabase RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1...

watchTowr-vs-SonicWall-PreAuth-RCE-Chain

SonicWall SMA 100 PreAuth RCE Chain PoC PoC for SonicWall SMA 100 PreAuth RCE Chain CVE-2023-44221, CVE-2024-38475 See our blog post for technical details https://github.com/user-attachments/assets/b157b39c-d7bd-4385-af7a-e465f8fd4a41 PoC in Action python watchTowr-vs-SonicWall-PreAuth-RCE-Chain....

Exploits

Exploits Original CVEs, exploit PoCs and security advisories by @kmkz · boffsec-services.com · @kmkzsecurity 2026 File| Target| Type| CVSSv3 ---|---|---|--- CVE-2026-22191-SicuroWeb-ATI-chain.txt| SicuroWeb / Beghelli Sicuro24| Advisory 3-CVE chain| 9.3 CVE-2026-22191-POC.py| SicuroWeb / Beghelli...

CVE-2022-36804-PoC

CVE-2022-36804-PoC Multithreaded exploit script for CVE-2022-36804 affecting most BitBucket versions 8.3.1 See the full advisory here https://jira.atlassian.com/browse/BSERV-13438 All credit to TheGrandPew for discovery The script will automatically detect public repositories located on bitbucket...

watchTowr-vs-Citrix-Netscaler-CVE-2026-88772

watchTowr-vs-Citrix-Netscaler-CVE-2026-88772 Detection Artifact Generator for Citrix NetScaler CVE-2026-88772 See our blog post for technical details. Detection in Action / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / / /...