Progress Kemp Flowmon - Command Injection

In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands. id: CVE-2024-2389 info: nam...

Juggle <= 1.6.0 - Unauthenticated Exposed H2 Database Console

Juggle ships the H2 database web console enabled and reachable from non-localhost by default. No application-level authentication covers the /h2-console path, and the shipped default datasource credentials sa/juggle are known. An unauthenticated remote attacker can reach the console and, using th...

Flowise < 3.1.3 - Remote Code Execution

Flowise prior to 3.1.3 contains a remote code execution vulnerability caused by allowing authenticated users to set arbitrary TypeORM DataSource options including entities that load local JavaScript files, letting authenticated users execute arbitrary code on the server, exploit requires user...

Fortinet FortiWLM Unauthenticated Command Injection Vulnerability

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands Successful exploitation of this vulnerability could allow an attacker to...

SRS - Command Injection

SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerable to a drive-by command injection. id: CVE-2023-34105 info: name: SRS - Command Injection author: iamnoooob,rootxharsh,pdresearch severity: high description: | SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerab...

WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read

WGDashboard = 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root. id: CVE-2026-15733 info: name: WGDashboard = 4.3.2 - Authenticated OS Command Injection /etc/passwd Read author: str4k3r,0xAkoko...

Apache Struts2 S2-053 - Remote Code Execution

Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 uses an unintentional expression in a Freemarker tag instead of string literals, which makes it susceptible to remote code execution attacks. id: CVE-2017-12611 info: name: Apache Struts2 S2-053 - Remote Code Execution author: pikpikcu...

Apache Struts 2.0.0-2.5.25 - Remote Code Execution

Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. id: CVE-2020-17530 info: name: Apache Struts 2.0.0-2.5.25 - Remote Code Execution author: pikpikcu severity: critical...

sxwp2shell

root@kitploit: / / / / / / | |/ / \ / / / / / / / / | / / / / / / / // / / / / / // | //// ///// /////|| sxwp2shell — Pre-auth RCE exploit for WordPress via REST API batch-route confusion CVE-2026-63030 + SQL injection CVE-2026-60137. Affected: WP 6.9.0–6.9.4 / 7.0.0–7.0.1 Install...

CVE-2021-41773-PoC

CVE-2021-41773-PoC 🚀 Mode Of Use root@kitploit: ./exploit.sh 172.17.0.2 id uid=33www-data gid=33www-data groups=33www-data !CAUTION Este script es SOLO para fines educativos y de pentesting autorizado. El uso indebido de esta herramienta en sistemas sin permiso expreso es ILEGAL. El autor no se...

-CVE-2026-7465

-CVE-2026-7465 CVE-2026-7465 Spectra Gutenberg Blocks Authenticated RCE Exploit...

CVE-2026-45829

🚨 CVE-2026-45829 - ChromaDB Pre-Auth RCE Critical Remote Code Execution in ChromaDB Vector Database 📌 Overview CVE-2026-45829 is a critical pre-authentication Remote Code Execution vulnerability in ChromaDB , a popular open-source AI Vector Database. An unauthenticated attacker can exploit the wa...

rsc-security-auditor

🛡️ RSC Security Auditor Detect critical security vulnerabilities CVE-2025-66478, CVE-2025-55184 in your Next.js & React Server Components stack. 🚨 Urgent: Recent disclosures Dec 2025 have revealed critical DoS and RCE vulnerabilities in React Server Components. This tool helps you audit your...

cosmicsting-cve-2024-34102-exploit

CosmicSting CVE-2024-34102 Exploit Suite Complete exploit suite for CVE-2024-34102 - The CosmicSting XXE vulnerability in Adobe Commerce / Magento 2.4.x. Vulnerability Details CVE : CVE-2024-34102 CVSS 9.8 Type : XML External Entity Injection XXE Impact : Unauthenticated remote file read, SSRF,...

CVE-2026-27384

CVE-2026-27384 CVE-2026-27384 — W3 Total Cache mfunc/eval RCE Scanner Plugin: W3 Total Cache Plugin Slug: w3-total-cache CVE ID: CVE-2026-27384 CVSS Score: 9.8 Critical CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Vulnerability Type: Unauthenticated Arbitrary Code Execution Code...

react2shell-burp

React2Shell RCE Scanner and Validator CVE-2025-55182 Creator: j0lt Collaborator: https://github.com/shashank18 A Burp Suite extension that detects and validates the React2Shell vulnerability CVE-2025-55182 — a pre-authentication remote code execution flaw in React Server Components. The extension...

Ultimate-CVE-2026-61511

CVE-2026-61511 – Proof of Concept Educational and defensive Proof of Concept PoC for validating exposure to the vBulletin vulnerability CVE-2026-61511 – Unauthenticated Remote Code Execution. Contact Telegram: https://t.me/thecodeb0ss Overview This repository provides a defensive detection and...

react2shell

React2Shell CVE-2025-55182 Next.js: CVE-2025-66478 Unauthenticated RCE in React Server Components Flight Protocol - PoC Exploit Description React Server Components Flight protocol deserialize attacker-controlled multipart/form-data without validating prototype-chain access. A single unauthenticat...

CVE-2026-3296

CVE-2026-3296 CVE-2026-3296 is a CVSS 9.8 Critical unauthenticated PHP Object Injection vulnerability in the Everest Forms WordPress plugin CVE-2026-3296 — Everest Forms PHP Object Injection Scanner Plugin: Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder Plugin Slug...

CVE-2021-22986

CVE-2021-22986 This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only...