CVE-2019-19781-CitrixRCE

Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781 References: https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ Bypassing: 1 - Deleted / Modified scripts at: /vpn/../vpns/portal/scripts/ 2 - Forward Slash "/" issues after perl commnad...

CVE-2024-5084-Red-Team

🚀 HashForm Exploit – Lab Demo This repository contains a proof-of-concept exploit for CVE-2024-5084, a vulnerability found in the Hash Form WordPress plugin. It’s meant only for learning, lab testing, and security research. 📌 About the Vulnerability CVE ID: CVE-2024-5084 Issue: Unauthenticated fi...

CVE-2020-23584

CVE-2020-23584 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Unauthenticated remote code execution on "OPTILINK OP-XT71000N, Hardware Version: V2.2". The issue occurs when the attacker passes arbitrary commands with IP-ADDRESS using " ...

refreshing-soap-exploit

This is a proof of concept for CVE-2022-41622, which is a CSRF in F5 Big-IP that leads to remote code execution. Using this is a bit finnicky, but I'll walk you through my favourite usecases. The vulnerability The core vulnerability is a cross-site request forgery in F5 Big-IP's SOAP interface,...

DIR-890L-1.20-RCE

D-Link DIR-890L RCE Affected Version: = v1.22B01 Hotfix latest Firmware: Here This model has reached the end of its life-cycle. The resources associated with these products have ceased their development and are no longer supported. D-Link Systems, Inc. recommends retiring these products and...

CVE-2021-1732-EXP-

This repository does not have a README...

DocViewerExploitApp

DocViewerExploit App - CVE-2021-40724 This is the source code to exploiting the Document Viewer by MobileHackingLab. About the Vulnerable App This is an exploit app for the MobileHackingLab DocumentViewer Abdroid App Dynamic Code Loading RCE challenge. This challenge emulates CVE-2021-40724...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

CVE-2017-12617

updated version of https://github.com/cyberheartmi9 CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected...

cve-2020-11651

CVE-2020-11651 This is a POC for CVE-2020-11651, which obtains pre-auth RCE on a salt stack master, and/or all the associated minions. Some light details on the issue are here. POC for 2020-11652 not included. This obtains command execution on the master by creating a runner of salt.cmd with...

CVE-2026-60004

🚨 CVE-2026-60004 - RCE Critical Remote Code Execution in Gitea via diffpatch Git Hook A critical Remote Code Execution RCE vulnerability allowing arbitrary command execution through thediffpatch API endpoint by abusing Git hook execution. 📖 Overview CVE-2026-60004 is a Critical Remote Code...

react2shell-scanner

🚨 React2Shell Scanner CVSS 10.0 RCE in React Server Components. Is your React 19 app vulnerable? Fast, accurate scanner for CVE-2025-55182 React2Shell - a critical remote code execution vulnerability exploited in the wild. Zero false positives with intelligent Server Components detection. 🚨 About...

CVE-2026-20841

CVE-2026-20841 - Windows Notepad RCE PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary protocol handlers to be triggered via clickable links. Disclaimers 1. Not my discovery. Credit goes to the...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

Inject-PHP-to-JPG-Using-Jhead

Inject-PHP-to-JPG-Using-Jhead $ pkg install vim or apt-get install vim $ pkg install jhead or apt-get install jhead $ jhead -h for help $ jhead -purejpg yourfiles.jpg $ jhead -ce yourfiles.jpg Click ESC typed :x to save $ jhead yourfiles.jpg Example : site.com/youfiles.php?cmd=Command Here...

React2Shell-Library

React2Shell Library A curated list of resources regarding CVE-2025-55182 , the critical Remote Code Execution RCE vulnerability in React Server Components known as "React2Shell". Objective: To document the history, mechanics, and remediation of the React2Shell vulnerability for researchers and...

CVE-2020-5902

CVE-2020-5902 / \ \ / / | | \ / \ \ / \ | / \ / \ \ | | \ \ / /| | | | | | | | | || || | | | | | | | \ / / | |/ /| | | |/ /| | | || \, | | | |/ / | | \ / | | / /| || / /| || | | / /| || / / | / || ||/|/ |/ // /| CVE-2020-5902-Scanner.py @nsflabs The F5 BIG-IP Traffic Management User...

CVE-2024-4577-RCE

PHP CGI Argument Injection CVE-2024-4577 RCE 📜 Description In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

Mailcow-CVE-2022-31245

Mailcow CVE-2022-31245 CVE-2022-31245: RCE and Domain Admin privilege escalation for Mailcow. Including POC. Reported and fixed: 2022-05 Patched Version: https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-05d CVE: https://vulners.com/cve/CVE-2022-31245 CVE-2022-31245: Command...