CVE-2022-26134

CVE-2022-26134 Confluence Pre-Auth Object-Graph Navigation Language OGNL Injection Confluence is a web-based workspace collaboration product that is developed by Atlassian. It can be deployed on-prem or as part of Atlassian Cloud. It consists of 3 key features: page, space and page tree. Page: Yo...

CVE-2025-55182-Exploit-PoC-Scanner

CVE-2025-55182 - React Server Components RCE Exploit v2.0 A comprehensive security research tool for testing CVE-2025-55182 and CVE-2025-66478 vulnerabilities in React Server Components RSC and Next.js Server Actions. Vulnerability Overview...

Apache-Solr-RCE-via-Velocity-template

Apache-Solr-RCE-via-Velocity-template 参考链接 漏洞产生原因： 1. 当攻击者可以直接访问Solr控制台时，可以通过发送类似/节点名/config的POST请求对该节点的配置文件做更改。 2. Apache...

RP_Import_RCE

Real Player 'external::Import' Arbitrary file download, Directory Traversal Vulnerabilities leads to Remote Code Execution video demo: https://youtu.be/CONlijEgDLc Real Player uses Microsoft Internet Explorer functionality and exposes properties and methods through a special mean which is...

RP_DCP_Code_Exec

Real Player 'DCP://' URI Remote Arbitrary Code Execution Vulnerability video demo: https://youtu.be/AMODp3iTnqY The 'DCP://' URI scheme is an internal protocol used by Real Player to retrieve URLs to display in the Player browser tab. It stands for 'Data Cache Protocol'. It will retrieve files fr...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...

EUVD-2026-70709

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85046

A type confusion in the V8 JavaScript engine in Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page. The vulnerability was reported by Salvatore Gulizia (Serotav) on 2026-08-04 and is ra...

cve-2024-56348

JetBrains TeamCity Authentication Bypass + RCE CVE-2024-56348 PoC 📜 Description CVE-2024-56348 is a critical authentication bypass vulnerability in JetBrains TeamCity on-premises affecting all versions prior to 2024.12. The REST API improperly handles requests to paths containing ;.jsp, allowing ...

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

CVE-2026-58400

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing FEATURESECUREPROCESSING and without disabling Java extension functions...

zencart_auth_rce_poc

zencartauthrcepoc CVE-2021-3291 1- login as admin 2- get any modules edit page 3- inspect element any true radiobox 4- change true to true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- click update 6- to trig command go again edit page CVE-2021-3291 https://vulners.com/cve/CVE-2021-3291 POC...

CSRF-to-RCE-on-Backdrop-CMS

CSRF to RCE on Backdrop CMS 1.20 This PoC describe how to exploit CSRF on Backdrop CMS Version 1.20 with escalation to RCE. CVE ID CVE-2021-45268 Description The Backdrop CMS version 1.20 allows plugins to be added via ZIP files uploaded to the site. And because it does not have anti-CSRF...

CVE-2022-22963

CVE-2022-22963 Spring Cloud Function SpEL Expression Injection Remote Code Execution Vulnerability Detection and Exploitation Tool. Vulnerability Overview CVE-2022-22963 is a high-severity RCE vulnerability CVSS 9.8 in the routing functionality of Spring Cloud Function. When the application enabl...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated RCE PoC Disclaimer This repository was created for security research and educational purposes only. Use it only in an isolated lab environment. Using it against unauthorized systems is a violation of the Information and Communications Network Act and is...

CVE-2026-21877

CVE-2026-21877 Lab Environment for CVE-2026-1357 1. Build the environment sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo sudo chmod +x networkmonitor.py sudo docker compose up --build -d Firefox : http://localhost:5678 For test...