CVE-2020-14882

CVE-2020-14882 This script enables remote code execution RCE on Oracle WebLogic Server using an unauthenticated GET request. It exploits the vulnerability CVE-2020-14882. By executing arbitrary commands, an attacker can gain unauthorized access to the server. Exploit Details Exploit Title: Oracle...

CVE-2020-1938-Exploitation

CVE-2020-1938 Exploitation Apache Tomcat arbitrary JSP upload leading to RCE Description CVE-2020-1938 is a critical vulnerability which impacts Apache Tomcat from 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 ⚠️ This was exploited in a Hack The Box lab. 🔗 Reference: NIST NVD Entry...

CVE-2026-54420

CVE-2026-54420 LiteSpeed cPanel ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual...

CVE-2024-5084

Wordpress Hash Form – Drag & Drop Form Builder = 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution CVE-2024-5084 The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fileuploadaction'...

CVE-2024-37054

CVE-2024-37054 — MLflow pyfunc Deserialization RCE Severity: Critical Affected: MLflow 0.9.0 – 2.14.1 Type: Arbitrary code execution via Python pickle deserialization Description mlflow.pyfunc.loadmodel deserializes pythonmodel.pkl from the artifact store without any sanitization. An attacker who...

Pyrescom-Termod-PoC

Pyrescom-Termod-PoC This is the Proof-of-concept exploit code for three vulnerabilities discovered by Jonas Mattsson and Hugo van den Toorn at Outpost24 Ghost Labs. These vulnerabilities are discovered in the web server component on a Pyrescom Termod4 time control machine. These vulnerabilities c...

CVE-2020-27955-LFS

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2024-6387-OpenSSH-Analysis

CVE-2024-6387 OpenSSH Analysis Overview Security analysis of CVE-2024-6387 vulnerability affecting OpenSSH server. Tools Used Kali Linux Nmap Metasploitable 2 Vulnerability Details CVE-2024-6387 is a vulnerability in OpenSSH caused by a race condition in sshd, which may allow an unauthorised remo...

CVE-2022-24086-CVE-2022-24087

CVE-2022-24086-CVE-2022-24087 The blog post that I written about Magento and Adobe Commerce RCE vulnerability CVE-2022-24086&CVE-2022-24087 for Picus Cyber Talent Academy Assignment can be found CVE-2022-24086&CVE-2022-24087.pdf...

CVE-2025-43300

📚 CVE-2025-43300 - Detailed Vulnerability Analysis 🎯 Summary CVE-2025-43300 is a buffer overflow vulnerability in DNG Digital Negative file processing caused by an inconsistency between TIFF metadata and JPEG data , allowing remote code execution RCE. 🔍 1. DNG FILE ANATOMY Layered Structure: DNG...

CVE-2024-27348

CVE-2024-27348 This is a repository for Apache HugeGraph Remote Code Execution vulnerabilityCVE-2024-27348 Docker docker pull hugegraph/hugegraph:1.0.0 docker run -it --name hgserver -p 8081:8080 hugegraph/hugegraph:1.0.0 docker-compose.yml services: web: image: vulhub/hugegraph:1.2.0 ports: -...

CVE-2026-38165-SSTI-

CVE-2026-38165 SSTI Velocity Server-Side Template Injection SSTI in XDocReport allows Remote Code Execution via Apache Velocity engine Bug Definition Overview of the vulnerability Server-Side Template Injection SSTI is a web security vulnerability that allows attackers to inject malicious code in...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploadi...

Codiad-CVE-2018-14009

install codiad @ git clone https://github.com/Codiad/Codiad.git Steps to reproduction 1. Setup a vulnerable environment on ubuntu server with Codiad 2.8.4 latest version @ chmod o+w config.php @ chmod o+w workspace @ chmod o+w plugins @ chmod o+w themes @ chmod o+w data 2. @ git clone...

CVE-2020-17530

OGNL Injection Exploit Summary Simple Python script to exploit OGNL injection vulnerabilities in Apache Struts2/Tomcat and execute system commands. Usage pip install requests colorama python3 exploit.py -u http://target/index.action -c "id"...

CVE-2020-5245

CVE-2020-5245 1. Run mvn clean install to build your application 2. Start application with java -jar target/dropwizard-1.0-SNAPSHOT.jar server config.yml 3. To check that your application is running enter url http://localhost:8080 some error in pom.xml plugins were not affected reproduce Reproduc...

bludit-CVE-2019-17240

bludit-CVE-2019-17240 Bypass bludit mitigation login and upload malicious to call a rev shell...

XSS2Shell

XSS2Shell ULTIMATE v3.0 WordPress Pre-Auth XSS → RCE Chain Exploit Developed by G0D150NE 📌 Features 🔍 Auto-detect XSS & WordPress version 🎯 3 Modes: Auto, XSS, Direct 📡 Callback server to capture credentials 🐚 WebShell with multiple execution methods 🔄 Persistence cron job, hidden admin,...

cve-2026-21858

CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Critical Affected| = 0.211.0 RCE Fixed| 1.121.0 AFR / 1.120.4+ RCE Disclosed| 2026-01-07 11:09 UT...

CVE-2025-37164

CVE-2025-37164 A remote code execution issue exists in HPE OneView. How does this detection method work? This template matches on the OneView title tag, extracts the version from the JavaScript artifactVersion variable, and flags instances running versions below 11.00 as potentially vulnerable...