CVE-2025-55182-NextJS-RCE-PoC

CVE-2025-55182 React2Shell Reproduction Environment ⚠️ EDUCATIONAL PURPOSE ONLY This repository is created strictly for educational and research purposes. It demonstrates a critical vulnerability in React Server Components Next.js to help developers understand the risks and importance of updating...

CVE-2026-23744-poc

CVE-2026-23744 — mcpJam Remote Code Execution RCE Exploit A Python 3 proof-of-concept exploit for CVE-2026-23744 , an arbitrary command execution vulnerability affecting mcpJam v1.4.2. This utility automates payload delivery by transparently Base64-encoding commands before transmission, helping...

wp2shell-rce

WP2Shell RCE An assessment and scanning utility designed to detect exposure to the WP2Shell exploit chain in WordPress Core installations across single endpoints or large target lists. ⚠️ Disclaimer Only scan systems you own or are authorized to assess. Unsanctioned scanning or testing of...

CVE-2025-55182-POC

CVE-2025-55182-POC React2Shell POC Usage: sudo python3 hehe.py -t -c Example: ❯ sudo python3 hehe-t 12.05.12.05 -c "id" . .. . | \ | | / \ / || || | | | / || | | | | || | | | | | | | | / ^ \ | ,----'---| |----| | | | | ----| || | | | | | | | | / | | / /\ \ | | | | | | | | \ \ | | | | | | | | | |...

wp2shell-Wordpress-TOWN

wp2shell by : lucifer0xf Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

CVE-2024-42640

CVE-2024-42640 angular-bug CVE-2024-42640 Unauthenticated Remote Code Execution via Angular-Base64-Upload Library for more details: blog Introduction angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.p...

CVE-2026-38751

CVE-2026-38751 — OpenSTAManager Module Upload RCE Authenticated RCE via unvalidated ZIP upload in the module update endpoint. Affected: OpenSTAManager = 2.10.x Requirements pip install requests Usage Reverse shell Penelope or any listener python3 exploit.py -u http://TARGET -U admin -P admin...

react2shell-CVE-2025-55182-full-rce-script

Next.js React2Shell CVE-2025-55182 Exploit Tool A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION This vulnerability CVSS 10.0 is being actively...

Shellshock_CVE-2014-6271

Shellshock CVE-2014-6271 Shellshock docker-compose.yml, poc.py 파일을 다운 받아 주세요 반드시 pip install requests 를 통해 requests 라이브러리를 다운받아 주세요!!! uv를 사용하시는 분들은 uv를 통해 requests 라이브러리를 venv 안에 넣어주세요!!! CVE Official Description --- In GNU Bash versions prior to 4.3, there was a problem with handling strings th...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description This could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website. usage:...

Log4j-_Vulnerability

The Web Is Vulnerable to CVE-2021-44228 This web application is vulnerable to CVE-2021-44228, a critical security flaw in Apache Log4j 2 known as Log4Shell. This vulnerability allows unauthenticated attackers to remotely execute malicious code by sending specific input that is logged by the syste...

CVE-2025-2249

🔐 WordPress SoJ SoundSlides Plugin ⚠️ DISCLAIMER: This exploit is for educational and authorized testing purposes only. 📌 Vulnerability Summary Plugin: SoJ SoundSlides Affected Versions: = 1.2.2 Type: Authenticated Contributor+ Arbitrary File Upload Patch Status: ❌ No official fix available The So...

CVE-2025-25257

CVE-2025-25257 - FortiWeb Pre-Auth SQL Injection to RCE 07/09/2025 by TheStingR Disclaimer: This proof-of-concept PoC is provided for authorized security testing and research purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. Users are...

Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution

Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution Script that exploits the vulnerability that allows remote code execution in Ruby 2.3.8 ​​with CVE-2016-2098 Usage ./RubyOnRailsActionPackInlineERB-RemoteCodeExecution.py -h --target-host TARGETHOST --port PORT --target-uri TARGETURI...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

cve-2025-32433-erlang_ssh_rce_reproduction

CVE-2025-32433: Erlang/OTP SSH Daemon Pre-Auth Remote Code Execution CVSS Score: 10.0 CRITICAL Status: Actively Exploited in the Wild Disclosure: June 2025 Overview CVE-2025-32433 is a critical unauthenticated remote code execution vulnerability in the SSH server implementation ssh application...

xerteonlinetoolkits-rce

Xerte Online Toolkits = 3.15 Remote Code Execution Xerte Online Toolkits versions 3.15 and earlier suffer from 3 vulnerabilities in the /editor/elfinder/php/connector.php component, which may be chained together by an unauthenticated attacker to achieve Remote Code Execution RCE. Affected Version...

cve-2025-11953-vulnerability-demo

React Native CLI Command Injection Demo CVE-2025-11953 ⚠️ VULNERABILITY DEMONSTRATION ⚠️ JFSA-2025-001495618 - Critical Command Injection in React Native CLI CVE : CVE-2025-11953 CVSS Score : 9.8 Critical Affected Package : @react-native-community/cli-server-api Vulnerable Versions : 4.8.0, 20.0.0...

CVE-2016-2098-PoC

CVE-2016-10033-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Has interactive shell, nice argparse stuff asw Usage usage: script.py -h --url URL --param PARAM --proxy --raw --no-color...

CVE-2026-59827

CVE-2026-59827 — Unsafe Deserialization of H2 Query Results in Metabase GHSA-w95f-x9v9-wv36 | CVSS 9.9 Critical | CWE-502: Deserialization of Untrusted Data Overview CVE-2026-59827 is a critical remote code execution vulnerability in Metabase, the popular open-source business intelligence and dat...