CVE-2025-13486

Mass Exploit CVE-2025-13486 Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepareform ⚠️ Vulnerability Details The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via th...

-CVE-2014-6271

/ || | | | | | | | / || | | |/ \ / | |/ / \ | || | | | | | | \ | || | | | | | | ' / | | || || | | | || | || . \ |/|| |||||/|| ||/ ||\ CVE-2014-6271 — Shellshock Remote Code Execution via Bash Environment Variable Injection "A flaw hidden in Bash for decades that shook the foundations of the...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontroll...

CVE-2025-67511

CVE-2025-67511: Tricking a Security AI Agent Into Pwning Itself Hacktive Security blog post for CVE-2025-67511 Blog Post Link : https://www.hacktivesecurity.com/blog/2025/12/10/cve-2025-67511-tricking-a-security-ai-agent-into-pwning-itself/ TL;DR A command injection vulnerability in the function...

ToolShellFinder

🛠️ ToolShellFinder: CVE-2025-53770 & CVE-2025-53771 Detection A high-performance PowerShell 7+ script for scanning IIS logs to detect signs of exploitation related to ToolShell , specifically targeting the zero-day vulnerabilities CVE-2025-53770 and CVE-2025-53771 in Microsoft SharePoint. This...

L4J-Vuln-Patch

NOTICE This tool is no longer necessary mojang has released its own patch which should cover everyone who is affected https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition WARNING THIS EXPLOIT EFFECTS BOTH CLIENTS AND SERVERS There is currently a exploit...

CVE-2025-55182-Waf

Next.js/React RSC Scanner & Exploit - RCE This tool is designed for security researchers and penetration testers to detect and exploit the CVE-2025-55182 vulnerability in Next.js/React RSC applications. It provides multiple scanning modes, exploitation features, and WAF bypass techniques. ✨...

CVE-2016-2098-PoC

CVE-2016-10033-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Has interactive shell, nice argparse stuff asw Usage usage: script.py -h --url URL --param PARAM --proxy --raw --no-color...

CVE-2026-25769

🚨 CVE-2026-25769 - Wazuh Insecure Deserialization RCE Critical Worker ➜ Master Remote Code Execution in Wazuh Cluster Mode Unsafe deserialization in Wazuh cluster communications allows a compromised worker node to achieve root RCE on the master node. 📌 Overview CVE ID: CVE-2026-25769 Product: Waz...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution, works with arbitrary DLL files. Background Although many PoC are already around the internet, I guessed to give myself a run to weaponizing this vulnerability, as what I...

cve-2022-27438

CVE-2022-27438 Caphyon Ltd Advanced Installer 19.3 "CustomDetection" Update Check Remote Code Execution Vulnerability. Usage: python3 cve-2022-27438poc.py Details in the report at gerr.re. Steps to reproduce For other affected products, you have to change the update server and update configuratio...

CVE-2019-6340

Drupal Drupal 8.6.x RCE Exploit exploit CVE: CVE-2019-6340 CMS: Drupal CMS Version: Drupal 8.6.x tested condition: -Drupal 8.6.x, 8.6.10 OR Drupal 8.5.11 -RESTful Web Services module is enabled...

CVE-2026-25938-FUXA-Unauthenticated-RCE

CVE-2026-25938 - FUXA Unauthenticated RCE 1. What is FUXA? FUXA is a free, open-source, web-based SCADA Supervisory Control and Data Acquisition and HMI Human-Machine Interface platform used for industrial automation , IoT , and real-time process visualization. It lets users build custom...

CVE-2026-28326-check

SolarWinds Access Rights Manager Unauthenticated RCE — Vulnerability Detection Script An unauthenticated patch-state check for CVE-2026-28326, the unauthenticated remote code execution vulnerability in SolarWinds Access Rights Manager ARM, fixed in ARM 2026.2.1 on 2026-09-17. CWE-798, CVSS 8.8 Hi...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — associated with WannaCry spread For this lab, the goal was to triage another well-known real-world vulnerability, this time EternalBlue, the SMBv1 flaw that was famously exploited by the WannaCry ransomware outbreak. Step 1: Open the CVE in NVD I went t...

CVE-2020-0796

CVE-2020-0796: SMBGhost - Analysis and Ethical Exploitation Introduction CVE-2020-0796, also known as "SMBGhost," is a critical security vulnerability affecting Microsoft Windows operating systems. It falls under the "wormable" category, meaning it can rapidly propagate across networked systems...

STIG-Edge-RCE-CVE2025-9478

STIG – Microsoft Edge Chromium 139.0.3405.125 Remote Code Execution CVE-2025-9478, Plugin ID: 258091 Before Finding: Microsoft Edge version 139.0.3405.86 was outdated and vulnerable to a critical Remote Code Execution RCE flaw CVE-2025-9478. Risk: Attackers could exploit a use-after-free in ANGLE...

CVE-2019-18818_CVE-2019-19609

Exploits for CVE-2019-18818 and CVE-2019-19609 This repository contains a Python script to exploit two vulnerabilities: CVE-2019-18818 and CVE-2019-19609. CVE-2019-18818 This vulnerability allows an attacker to reset the password of an admin user in the Strapi CMS. Usage 1. Modify the target and...

CVE-2025-55182-NextJS-RCE-PoC

CVE-2025-55182 React2Shell Reproduction Environment ⚠️ EDUCATIONAL PURPOSE ONLY This repository is created strictly for educational and research purposes. It demonstrates a critical vulnerability in React Server Components Next.js to help developers understand the risks and importance of updating...

CVE-2023-24059

CVE-2023-24059 Grand Theft Auto V for PC allows attackers to achieve partial remote code execution or modify files on a PC, as exploited in the wild in January 2023. authentication| complexity| vector ---|---|--- not available| not available| not available confidentiality| integrity| availability...