DrayTek - Remote Code Execution

DrayTek Vigor2960 1.3.1Beta, Vigor3900 1.4.4Beta, and Vigor300B 1.3.3Beta, 1.4.2.1Beta, and 1.4.4Beta devices allow remote code execution as root without authentication via shell metacharacters to the cgi-bin/mainfunction.cgi URI. id: CVE-2020-8515 info: name: DrayTek - Remote Code Execution...

CraftCMS - Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45195 info: name: Apache OFBiz -...

Apache ActiveMQ - Remote Code Execution

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

Apache OFBiz - Improper Authorization & Remote Code Execution

Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...

Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution

Zoho ManageEngine ADSelfService Plus version 6113 and prior are vulnerable to a REST API authentication bypass vulnerability that can lead to remote code execution. id: CVE-2021-40539 info: name: Zoho ManageEngine ADSelfService Plus v6113 - Unauthenticated Remote Command Execution author:...

CVE-2025-11170

CVE-2025-11170 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 🚀 WP移行専用プラグイン for CPI = 1.0.2 - Unauthenticated Arbitrary File Upload 📝 Description The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

CVE-2025-47812-Research

CVE-2025-47812 — Wing FTP Server RCE Research Context Cybersecurity observation internship carried out within the Akasec club 1337 Khouribga — July/August 2025. Vulnerability studied CVE : CVE-2025-47812 CVSS Score : 10.0 Critical Affected software : Wing FTP Server 7.4.4 Type : Remote Code...

CVE-2025-55182-MassPayloadAttack

CVE-2025-55182 Mass Payload Attack React2Shell A modified Mass RCE Exploit script for CVE-2025-55182 React2Shell targeting Next.js applications. This tool is a modification of the original PoC script by pax-k. While the original script targets a single host, this version is enhanced to support ma...

CVE-2023-27163---Maltrail-0.53---RCE

CVE-2023-27163---Maltrail-0.53---RCE root@kitploit: Create by TheAlchimist cve-2023-27163-maltrail.py for reverse shell...

CVE-2026-58138

🚨 CVE-2026-58138 — Unauthenticated Remote Code Execution 🔥 Critical Unauthenticated Remote Code Execution in Conductor Affected versions:3.21.21 → 3.30.2 📌 Overview CVE-2026-58138 is a critical unauthenticated Remote Code Execution RCE...

CVE-2024-12356

Unauthenticated Remote Code Execution in BeyondTrust Remote Support and Privileged Remote Access via Argument Injection and a PostgreSQL String-Escape Bypass Ethical Warning: Research, educational, and authorized testing purposes only. Please do not use against systems without permission...

CVE-2026-27876

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write to RCE CVSS 9.1 Critical | Arbitrary File Write | Remote Code Execution Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Summary Grafana's SQL Expressions feature sqlExpressions toggle uses an...

CVE-2015-8562

CVE-2015-8562 - Reverse shell python Exploit: Joomla 1.5 - 3.4.5 Object Injection RCE X-Forwarded-For header: root@kitploit: Vuln Date: 12/17/2015 Exploit Author: anarc0der Version: Joomla 1.5 to 3.4.5 CVE : CVE-2015-8562 How to: root@kitploit: Open one terminal and listen with nc: $ nc -lnvp 444...

PoC-CVE-2025-66224

OrangeHRM RCE Exploit - CVE-2025-66224 📋 Description This Proof of Concept PoC demonstrates a Remote Code Execution RCE vulnerability in OrangeHRM through command injection in the sendmailpath configuration parameter. The exploit works by: 1. Injecting a malicious payload into the MySQL database...

CVE-2024-7593

CVE-2024-7593 Description: CVE-2024-7593 is a critical vulnerability affecting multiple Pulse Secure products, including Pulse Secure VPN. This vulnerability allows an authenticated attacker with access to the management interface to execute arbitrary commands on the affected server. This can lea...

CVE-2024-38063

CVE-2024-38063 Research – Windows IPv6 Kernel Remote Code Execution 1. Project Overview This repository contains our research and analysis of CVE-2024-38063 , a critical vulnerability in the Windows TCP/IP stack. CVE stands for Common Vulnerabilities and Exposures. It is a standardized dictionary...

CVE-2025-55182-EXP

Herramienta de Explotación para CVE-2025-55182 Introducción a la Herramienta Esta herramienta está diseñada para detectar y explotar la vulnerabilidad CVE-2025-55182 presumiblemente una vulnerabilidad de ejecución de código en un framework relacionado con Next.js. Admite detección masiva de un so...

HackTheBox-Connected

Hack The Box: Connected — Professional Penetration Testing Writeup -blue?style=for-the-badge&logo=linux 📋 Ringkasan Eksekutif Executive Summary Connected adalah mesin Linux berbasis CentOS yang menjalankan sistem komunikasi VoIP FreePBX v16.0.40.7 terintegrasi dengan Asterisk. Alur eksploitasi...

CVE-2026-38526-POC

CVE-2026-38526 - Krayin CRM RCE Exploit Krayin CRM ≤ 2.2.x - Unrestricted File Upload leading to Remote Code Execution. This PoC exploits the vulnerable TinyMCE upload endpoint /admin/tinymce/upload to upload a PHP webshell and achieve command execution on the server. Features Full automatic logi...