CVE-2020-26217-XStream-RCE-POC

CVE-2020-26217-XStream-RCE-POC e.g package org.example; import com.thoughtworks.xstream.XStream; import java.io.IOException; public class CVE202026217 public static void mainString args throws IOException XStream xStream = new XStream; String payload = "\n" + " \n" + " \n" + " 0\n" + " \n" + " \n...

CVE-2026-63030-CVE-2026-60137

wp2shell Pre-Auth RCE PoC - CVE-2026-63030 + CVE-2026-60137 WordPress 6.9.0–6.9.4 / 7.0.0–7.0.1 For authorized penetration testing and security research only. Running this against systems without written authorization is illegal. The authors accept no liability for misuse. Overview wp2shell is a...

cve-2020-7247

cve-2020-7247 Exploit Title: OpenSMTPD 6.6.2 - Remote Code Execution. The new Date: 2020-01-29. Exploit Author: 1F98D. Original Author: Qualys Security Advisory. Vendor Homepage: https://www.opensmtpd.org/. Software Link: https://github.com/OpenSMTPD/OpenSMTPD/releases/tag/6.6.1p1. Version:...

CVE-2022-1388

CVE-2022-1388 BIG IP REST RCE On F5 BIG-IP 16.1.x versions prior to 16.1.2.2., 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Use the following...

CVE-2024-20931

CVE-2024-20931 CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839 Oracle Weblogic Usage: Setup JNDI, the specific one from https://github.com/WhiteHSBG/JNDIExploit/ Exploit: java -jar CVE-2024-20931.jar Please input target IP:127.0.0.1 Please input target port:7001 Please input RMI...

CVE-2025-67511

CVE-2025-67511: Tricking a Security AI Agent Into Pwning Itself Hacktive Security blog post for CVE-2025-67511 Blog Post Link : https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself/ TL;DR A command injection vulnerability in the function...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 References respect to the masters: CVE-2023-50386 vulnerability author's blog Java Security Manager Bypass Techniques Bypassing Reflection Protection in JDK 17 JNI Bypassing RASP Vulnerability exploitation...

CVE-2026-33017

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: docker build -t...

CVE-2023-26852-Textpattern-v4.8.8-and-

CVE-2023-26852-Textpattern-v4.8.8-and version below Textpattern v4.8.8 and Below are vulnerable to Unrestricted File Upload – Dangerous File Content Leading to Remote Code Execution This is my first repo. Don't beat me if i didn't explain well... Textpattern is a free and open-source content...

cve-2022-37298

CVE-2022-37298: RCE in Shinken Monitoring Versions affected: 2.4.3 Disclosure link: https://github.com/naparuba/shinken/commit/2dae40fd1e713aec9e1966a0ab7a580b9180cff2 CVE link: https://vulners.com/cve/CVE-2022-37298 Description The SafeUnpickler class found in shinken/safepickle.py implements a...

CVE-2017-1000486

CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...

CVE-2026-42945-NGINX-Rift-Toolkit

CVE-2026-42945 Nginx Rift Vulnerability Toolkit Comprehensive toolkit for scanning, patching, and testing CVE-2026-42945 - a critical RCE vulnerability in nginx Table of Contents Overview CVE Details Features Toolkit Components Requirements Installation Usage Workflow Examples Security...

struts2_cve-2017-5638

struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

CVE-2023-47460

CVE-2023-47460 Description SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure component Vulnerability Type SQL Injection Vendor of Product Knovos Discovery Affected Product...

CVE-2022-29464-mass

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Write by Chocapikk lightely modded by trhacknon Usage python exploit.py -u or: python exploit.py -f Zoomeye Dork CLI: zoomeye search 'title:"WSO2 Management Console"' -num 10 -filter=ip,port WEB: title:"WSO2 Management Console"...

HavocPwn

Havoc-PWN Authenticated This SSRF-RCE Chain was inspired by chebuya's CVE-2024-41570 SSRF POC and IncludeSecurity's Havoc Auth RCE both exploits are amazing and well crafted, please do give these creators appriciation for their hardwork! chebuya hyperreality How does it Work? The SSRF vulnerabili...

CVE-2024-53677-Docker

CVE-2024-53677 - Apache Struts 2 Remote Code Execution Vulnerability RCE Reproduction Environment This repository provides a Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2. This vulnerability involves path traversal and allows for arbitrary code executio...

CVE-2017-12636

CVE-2017-12636 Usage: python3 exp.py target version1.6|2.1 reverseip reverseport / \ | | | | / | |/ | | / / | / \ / || |/ | | / / | | | | ' / /'| |/' || | / /| | ' / /'/ / / / / | | | | | | || / / | /| | | | / /|| | / / | \ \ \ \ | /\ / / | ./ /\ |/ /| |./ / | |./ /| / |./ / / | /// / /...

CVE-2026-87902

CVE-2026-87902 - WordPress Core Unauthenticated LFI → RCE Validation Lab Security-research material for reproducing and validating CVE-2026-87902 GHSA-7hp8-65ch-5whp in an isolated, loopback-only Docker lab: an unauthenticated local file inclusion in WordPress core page-template resolution,...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit by kaal Exploits 1. HotelDruidExploit.py This Exploit will create new room with our PHP payload as a room name . Usage : $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...