CVE-2026-15981

CVE-2026-15981 SAML Single Sign On = 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter CVE-2026-15981 SAML Single Sign On ≤ 5.4.4 — Unauthenticated Authentication Bypass Proof-of-Concept Exploit Malformed Signature → opensslverify returns -1 → PHP loose cast to true →...

hdwebmobile-formula-pricing

HDWebmobile Formula Pricing Price a product from customer-entered numbers using a formula -- evaluated safely, never with PHP's eval. WordPress.org: https://wordpress.org/plugins/hdwebmobile-formula-pricing/ Requires: WordPress 6.9+, WooCommerce, PHP 7.4+ License: GPLv2 or later Description...

CrushFTP-auth-bypass-CVE-2025-31161

CrushFTP Authentication Bypass - CVE-2025-31161 A comprehensive toolkit for exploiting CVE-2025-31161, an authentication bypass vulnerability in CrushFTP that allows unauthorized user account creation. 🔍 What is CVE-2025-31161? CVE-2025-31161 is a critical authentication bypass vulnerability in...

CVE-2022-44900-demo-lab

CVE-2022-44900 Demo lab Demo webapp vulnerable to CVE-2022-44900. CVE-2022-44900 is a directory traversal vulnerability in SevenZipFile.extractall function of the python library py7zr version 0.20.0 and earlier that allow attackers to read and write arbitrary files on the local machine via...

CVE-2025-55182-POC

CVE-2025-55182 / CVE-2025-66478 Vulnerability Reproduction Environment This is a minimal MVP for reproducing the React2Shell CVE-2025-55182 and Next.js RSC RCE CVE-2025-66478 vulnerabilities. ⚠️ Warning This project is intended for security research and educational purposes only. Do not use it in...

CVE-2024-7627

Exploit for CVE-2024-7627 — Bit File Manager WordPress Unauthenticated RCE Exploit 📌 Description This repository contains a proof-of-concept PoC exploit for CVE-2024-7627 , a critical Unauthenticated Remote Code Execution RCE vulnerability in the Bit File Manager WordPress plugin versions 6.0 –...

CVE-2025-55182

Understanding React Server Components and the Flight Protocol React Server Components is a feature introduced in React 19 that allows components to be rendered on the server instead of in the client's browser. The server can handle complex computational tasks while only sending the rendered resul...

CVE-2025-68116

CVE-2025-68116 Author: @x0root Vulnerability: Stored Cross-Site Scripting XSS via Browser-Renderable Uploads SVG / HTML Affected Software: FileRise Note: GHSA-qrcv-vjvf-fr29 introduced a mitigation that prevented SVGs from rendering inside the FileRise web UI preview pane. This report documents a...

cve-2025-55182-poc

CVE-2025-55182 React2Shell - Academic Proof of Concept ⚠️ DISCLAIMER: EDUCATIONAL USE ONLY This repository contains functional exploit code for a critical vulnerability CVSS 10.0. It is intended strictly for academic research, security analysis, and educational purposes. Do not use this code...

CVE-2026-103090

Missing Authentication for Critical Function CWE-306 and Insufficiently Protected Credentials CWE-522 in the control plane enrollment status handler HandleEnrollStatus at GET /enroll/status in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha....

react2shell-interactive

React2Shell - CVE-2025-55182 Interactive PoC Interactive shell for exploiting CVE-2025-55182, a Remote Code Execution vulnerability in React Server Components. Disclaimer This tool is provided for EDUCATIONAL and AUTHORIZED SECURITY TESTING purposes only. Only use on systems you own or have...

CVE-2021-40346

CVE-2021-40346 — HAProxy Integer Overflow leading to HTTP Request Smuggling Vulnerability Summary HAProxy is an open-source reverse proxy and load balancer that handles load distribution and ACL access control rules processing. CVE-2021-40346 is an ACL bypass vulnerability that occurs when HAProx...

CVE-2026-20253-Splunk-Enterprise-Pre-Auth-RCE-

CVE-2026-20253 - Splunk Enterprise Pre-Auth RCE PoC CVE-2026-20253 - Splunk Enterprise Pre-Auth RCE PoC ⚠️ WARNING : This script is for educational purposes and testing in authorized environments only. Unauthorized use is prohibited and may be illegal. 📋 Description This repository contains a...

CVE-2026-13001

CVE-2026-13001 Podlove Podcast Publisher CVSS 9.8 Critical | Unauthenticated Arbitrary File Upload leading to Remote Code Execution Overview Critical vulnerability in the Podlove Podcast Publisher WordPress plugin versions up to and including 4.5.1 that allows unauthenticated attackers to upload...

FiberBreak

FiberBreak Exploitation framework for CVE-2025-55182 React2Shell - Critical RCE vulnerability in React Server Components. Overview CVE : CVE-2025-55182 CVSS : 10.0 CRITICAL Type : Remote Code Execution RCE Affected : React 19.0.0-rc.0 to 19.0.0, Next.js 15.0.0 to 15.0.3 Discovery : Lachlan Miller...

cve-2024-3400-panos_rce_reproduction

CVE-2024-3400: Palo Alto PAN-OS GlobalProtect Command Injection RCE CVSS 10.0 CRITICAL | CWE-78: OS Command Injection | Mass Exploited In The Wild Overview CVE-2024-3400 is a pre-authentication command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect portal and gateway interface...

cve-2023-34446

CVE-2023-36664: Ghostscript Remote Code Execution Vulnerability Summary CVE ID: CVE-2023-36664 Product: Ghostscript 10.01.2 Vulnerability Type: Remote Code Execution RCE Overview This vulnerability CVE-2023-36664 is an arbitrary code execution RCE vulnerability caused by Ghostscript's inadequate...

PowerShell-Pro-Obfuscator-Python

PowerShell Pro Obfuscator — Obfuscate & Virtualize PowerShell Code PowerShell Pro Obfuscator protects proprietary .ps1 scripts with renaming, polymorphic string and integer encryption, control-flow flattening, finite-state automata FSA, a VM engine, self-defending integrity checks, a protection...

CVE-2026-19745

Introduction Hi everyone, back in May I found decent vulnerablities in my router, today I can finally show everyone! Both vulnerablities in this repo are authenticated Denial of Service vulnerablities! I do not know the exact techial details of how or why these vulnerablities work, we never got a...

jsprime

Authors Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduction Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for...