CVE-2022-42889-RCE

CVE-2022-42889-PoC Proof of Concept for CVE-2022-42889 remote code execution exploit Text4Shell Vulnerability. Give a ⭐ for support ❤️ About this vulnerability CVE-2022-42889 is a new critical vulnerability similar to Spring4Shell and Log4Shell. Its a RCE Remote Code Execution vulnerability with...

CVE-2025-23061

CVE-2025-23061 - Mongoose Command Injection A proof of concept for the Command Injection vulnerability in Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 & CVE-2025-23061 Timeline November 7, 2024: Dat Phung identified a critical vulnerability in Mongoose and submitted a security report to Snyk...

ms08-067

📖 Overview This repository contains a Metasploit module implementation for the MS08-067 Windows Server Service vulnerability CVE-2008-4250. This is a classic remote code execution vulnerability affecting older Windows systems. 🛠️ Installation & Usage Prerequisites Kali Linux Metasploit Framework...

cve-2025-55182

CVE-2025-55182 aka React2Shell Setup test enviornment kiot :: /react2shell » docker compose build --no-cache kiot :: /react2shell » docker compose up POC Payload 1. RCE with response in body POST / HTTP/1.1 Host: localhost:3000 Next-Action: whatever Content-Type: multipart/form-data;...

CVE-2020-16898--EXP-POC

CVE-2020-16898 CVE-2020-16898 Windows TCP/IP Remote Code Execution Vulnerability EXP&POC Reproduction forforever: https://www.cnblogs.com/forforever/p/13846077.html POC CVE-2020-16898Checker-poc Command: Run PowerShell/CMD as administrator Powershell.exe -ExecutionPolicy UnRestricted -File...

Malicious code in voltswannts (PyPI)

Source: kam193 5fa306d5f7de491546822f6b026c35cc395d7d379258b7a8382b50468ce708b2 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in quasitonnts (PyPI)

Source: kam193 6b73744742a9129ba02b40242325d596780af7d8e456c7040e8458d29c125540 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in pyrechoasr (PyPI)

Source: kam193 abd16e8f67cf00b05cd9b944eaae2569a33cd419f50b3df499f203ea838fc447 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in tonemaptts (PyPI)

Source: kam193 19491cfac57ebbc5106857c286eb420bb2c84f246781670579fc4311cb7d1cad The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in emberlytts (PyPI)

Source: kam193 c53182f7339fc139b58f28bdd6588e55eb25c1c6d07089f6fc57b87f8339f547 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in glassbeakasr (PyPI)

Source: kam193 de05a7ca1743ea6c3ceba4abc7f5452783d567b39f20007aeb57071a6d4019ed The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in novalithtts (PyPI)

Source: kam193 4d136563fb3f5bd0febb4dc01f0af8d3ce9638271f1416f814d126fb49239840 The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

Malicious code in driftwavets (PyPI)

Source: kam193 e69baa6a16626f26b6f71e04ce89a53a693a06c6545446a9addbecfd6c95d92f The package belongs to a series of packages falsely advertising 'audio-analysis profiles' loader. In fact, the only purpose is to execute remote code, but the URL is not embedded in the package. It is likely a...

CVE-2024-25153

Exploit for CVE-2024-25153 Table of Contents Click to expand 1. Introduction 2. Installation 3. Usage 4. Contributing 5. License Introduction Welcome to the Exploit for CVE-2024-25153! This project is a solution to exploit the CVE-2024-25153 vulnerability and execute code remotely in Fortra...

Exploit_CVE-2019-17558-RCE

ExploitCVE-2019-17558-RCE Apache Solr 1.4 Injection to get a shell to Encode url, postrequest, getrequest...

CVE-2025-63406-PoC

CVE-2025-63406 PoC Installation Install dependencies pip install -r requirements.txt Or use a virtual environment python3 -m venv venv source venv/bin/activate On Windows: venv\Scripts\activate pip install -r requirements.txt Usage python3 CVE-2025-63406.py -u -n -p -c Arguments -u, --url: Base U...

Ashwesker-CVE-2025-52691

🚨 CVE-2025-52691 — Critical SmarterMail Vulnerability Status: 🔥 Critical — Immediate action required CVSS v3.1 Score: 10.0 / 10 Disclosure Date: December 29–30, 2025 🧩 Vulnerability Summary CVE-2025-52691 is a critical, unauthenticated arbitrary file upload vulnerability affecting SmarterTools...

CVE-2019-9580

CVE-2019-9580 - StackStorm exploiting CORS null origin to gain RCE Prior to 2.10.3/2.9.3, if the origin of the request was unknown, we would return null. null can result in a successful request from an unknown origin in some clients. Allowing the possibility of XSS style attacks against the...

CVE-2026-103441

CVE-2026-103441: Wikibase serialized entity object injection Reporter: Marco Paciaroni BomboBombone. The public action=parse API accepted PHP-serialized Wikibase entities. Unrestricted object construction could reach a Smarty destructor that unlinks a caller-selected path. Available PHP gadget...

CVE-2026-100520-laranode-path-traversal

CVE-2026-100520 — Path Traversal → RCE in Laranode File Manager Authorized security research. PoC for defensive and educational use only. Authenticated path traversal in the file-manager upload endpoint of Laranode lets a low-privileged tenant write arbitrary files outside their own home director...