CraftCMS_CVE-2023-41892

Craft CMS CVE-2023-41892 There is a Unauthenticated Remote Code Execution RCE affecting CraftCMS 4.0.0-RC1 - 4.4.14. Usage python3 craft-cms.py http://target Requirements The exploit make use of requests. Install it with : python3 -m pip install requests Acknowledgements...

CVE-2020-35728

Description FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl. How to RCE pom.xml 4.0.0...

confluence-hack

Confluence Hack CVE-2023-22515 exploit.py Exploit to create a new admin user Compromised audit log: As a reverence served: https://packetstormsecurity.com/files/175225/Atlassian-Confluence-Unauthenticated-Remote-Code-Execution.html and https://github.com/Chocapikk/CVE-2023-22515 pluginshellplug.j...

CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC

CVE-2023-27372 — SPIP Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The oubli parameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the...

Confluence-CVE-2022-26134

Confluence-CVE-2022-26134 This repository talks about Zero-Day Exploitation of Atlassian Confluence, it's defense and analysis point of view from a SecOps or Blue Team perspective Index About Timeline Understanding the Exploit List of IOCs Detection Strategy Mitigation Plans References About Over...

langflow-exploit

CVE-2025-3248 - Langflow Code Validation Endpoint RCE A proof-of-concept exploit demonstrating a remote code execution vulnerability in Langflow's code validation endpoint. This vulnerability affects Langflow versions prior to 1.3.0, allowing unauthenticated attackers to execute arbitrary code...

CVE-2024-41570-SSRF-RCE

python3 exploit.py --target https://10.10.11.49/ -i 127.0.0.1 -p 40056 python3 -m http.server 8000 nc -lvnp 4444...

whatsapp-rce-patched

This repository does not have a README...

CVE-2020-14882-weblogicRCE

Detection of RCE in Oracle's "WebLogic Server" CVE-2020-14882 / CVE-2020-14750 Summary: Detection of attempts to exploit CVE-2020-14882 and CVE-2020-14750 - Unauthenticated RCE in Oracle's Weblogic Server. References: Oracle's advisories: CVE-2020-14882...

nmap-CVE-2022-29464

nmap-CVE-2022-29464 nmap-CVE-2022-29464 is an NSE script for detecting CVE-2022-29464 vulnerability. Unauthorized and unrestricted arbitrary file transfer vulnerability that allows unauthenticated attackers to obtain RCEs on WSO2 servers by sending malicious JSP files. Vulnerability See good...

CVE-2023-43208

CVE-2023-43208 — Mirth Connect RCE Proof-of-Concept exploit for CVE-2023-43208 , an unauthenticated Remote Code Execution vulnerability in Mirth Connect versions prior to 4.4.1. Description Mirth Connect is a widely deployed open-source healthcare integration engine. This vulnerability leverages ...

php2shell-poc

php2shell CVE-2026-109618 & CVE-2026-109619 — PHP Pre-Auth RCE Exploit & Detection Toolkit Exploits · Detection · Lab · Writeup Five independent RCE chains exploiting PHP's session.uploadprogress and the Zend engine's OOM bailout. 14 years of vulnerable code — PHP 5.4.0 2012 through 8.5.11...

CVE-2025-2620-poc

CVE-2025-2620 Proof-of-Concept Exploit Overview This repository contains an advanced proof-of-concept PoC exploit for CVE-2025-2620 , a critical stack-based buffer overflow vulnerability discovered in the D-Link DAP-1620 router running firmware version 1.03. This vulnerability allows...

CVE-2019-0708

CVE-2019-0708 BlueKeep pre-auth RCE POC on Windows7 This repository demonstrates the remote code execution bug in Windows Remote Desktop Services RDS. Here is a POC code and technical report about BlueKeep vulnerability, which we developed before. NOTE: Our goal is helping analysts to get better...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

Ncast busiFacade - Remote Command Execution

The Ncast Yingshi high-definition intelligent recording and playback system is a newly developed audio and video recording and playback system. The system has RCE vulnerabilities in versions 2017 and earlier. id: CVE-2024-0305 info: name: Ncast busiFacade - Remote Command Execution author: BMCel...

SpiderFlow Crawler Platform - Remote Code Execution

A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/java/org/spiderflow/controller/FunctionController.java. The manipulation leads to code injection. It is possible to launch the attack...

WP Query Console <= 1.0 - Remote Code Execution

Improper Control of Generation of Code 'Code Injection' vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console- from n/a through 1.0. id: CVE-2024-50498 info: name: WP Query Console = 1.0 - Remote Code Execution author: s4e-io severity: critical...

TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection

TOTOLINK EX1800T V9.1.0cu.2112B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges. id: CVE-2024-34257 info: name: TOTOLINK EX1800T TOTOLINK EX1800T - Command Injecti...

WP Hotel Booking < 1.10.4 - PHP Object Injection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. id: CVE-2020-29047 info: name: WP Hotel Booking 1.10.4 - PHP Object...