CVE-2024-29671-POC

NEXTU FLETA Wifi6 Router RCE Exploit POC This document describes how the CVE-2024-29671 vulnerability was exploited in the NEXTU FLATA AX1500 Router firmware. Execution Environment This router is based on the MIPS architecture using the Realtek chipset with Little-Endian. The target router firmwa...

mi-laboratorio-log4shell

🚀 Automated Log4Shell CVE-2021-44228 Play & Plug Lab An automated, single-command security research laboratory designed to demonstrate and audit the Log4Shell CVE-2021-44228 Remote Code Execution RCE vulnerability. This project consolidates all necessary components vulnerable application, malicio...

CVE-2026-2586

Authenticated GlassFish EL Injection RCE CVE-2026-2586 An Expression Language Injection vulnerability in the GlassFish Administration Console allows an authenticated user to inject malicious EL expressions into parameters processed by the administrative web interface. Successful exploitation may...

CVE-2021-40444

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

cve-2023-38646-poc

Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 is a remote code execution vulnerability in Metabase. The vulnerability stems from a security flaw in Metabase's handling of JDBC connection strings when processing the unauthenticated API endpoint /api/setup/validate. An attacker can...

Apollo

Apollo A simple, lightweight Remote Access Tool written in Python Apollo is a cross-platform Windows, Linux, FreeBSD & MacOS Remote Access Tool for Python 3.4+. Its features are currently very basic but allow for post-exploitation remote code execution as well as obtaining information on the clie...

CVE-2024-43425-Poc

CVE-2024-43425-Poc CVE Overview CVE ID: CVE-2024-43425 Description: Moodle allows an authenticated teacher-level user to upload a malicious calculated question via the quiz editor interface. Impact: Remote Code Execution RCE Cause: Improper sanitization of mathematical payloads inside calculated...

CVE-2026-23744

root@kitploit: usage: exploit.py -h --lhost LHOST --lport LPORT --rhost RHOST CVE-2026-23744 - PoC options: -h, --help show this help message and exit --lhost, -l LHOST Attacker IP address --lport, -p LPORT Attacker port --rhost, -t RHOST Target URL...

Codify-TJNULL-OSCP-

Hack The Box — Codify Writeup Full penetration testing walkthrough and writeup for Codify machine on Hack The Box. 📌 Machine Info Field| Value ---|--- Name| Codify OS| Linux Difficulty| Easy Key Concepts| vm2 RCE CVE-2023-30547, SQLite DB Enum, Bcrypt Cracking, Bash Wildcard Pattern Matching Abus...

React2Shell_Exploit

React2ShellExploit CVE-2025-55182 I created simple react2shell CVE-2025-55182 python exploit USAGE 1. Save the script: Save the code above as exploit.py. 2. Update Hosts: Ensure reactor.htb resolves to the target IP in your /etc/hosts file. echo " reactor.htb" | sudo tee -a /etc/hosts 3. Start...

CVE-2023-41425

https://sploitus.com/exploit?id=3A833277-4844-5F02-AFEF-5EA6BA8AC1AC Wonder CMS RCE | | Description : XSS to RCE, Wonder CMS 3.2.0 evil/evil.php EOF root@kitploit: zip -r evil.zip evil/ JS payload that will install the new theme root@kitploit: cat xssrce.js var xhr=new XMLHttpRequest;...

CVE-2026-39023

CVE-2026-39023 RCE poc - RESPONSIVE filemanager v.9.14.0 last version - not patched Github project : https://github.com/trippo/ResponsiveFilemanager Requirements: Nothing is required, this exploit is unauthenticated. The Responsive Filemanager application is a web-based file management tool used ...

Computer-Security-Equifax-2017

Educational repo demonstrating real-world software vulnerabilities: Apache Struts2 CVE-2017-5638 RCE, data exfiltration, weak encryption, and mitigation strategies sanitization, monitoring, crypto best practices. Red team vs blue team demo of OS security flaws: exploit, persistence backdoor, and...

CVE-2026-22356

CVE-2026-22356: Jetpack CRM Path Traversal Vulnerability and RCE Warning: This tool should only be used in authorized test environments. The user is solely responsible for illegal use. 📥 Requirements root@kitploit: pip3 install requests urllib3 $ python3 exploit.py https://example.com --rce --cmd...

EUVD-2026-84534

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...

CVE-2026-94640

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052 information leak vulnerability in the DMG file parser of ClamAV A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information o...

cve-2022-36804

CVE-2022-36804 Bitbucket PoC This repository contains a Python exploit script for Atlassian Bitbucket Server/Data Center vulnerability CVE-2022-36804. The issue is a command-injection flaw in the Git archive flow, where crafted prefix parameters can be interpreted by the server and executed as...

CVE-2026-61612

creationtimestamp| type| source ---|---|--- 2026-09-22 15:32:08+00:00| seen| https://gist.github.com/alon710/3ba8e1fcc936f8ea3f0b915b4e9e571b 2026-09-22 16:35:02+00:00| published-proof-of-concept| https://github.com/ondata/ckan-mcp-server/security/advisories/GHSA-798p-78g2-v556...

UniBLEed

UniBLEed Unitree G1 RCE PoC & Scripts CVE-2026-76639 / CVE-2026-76640 technical details at boschko.ca/g1-ble-rce/ Use this repository only with robots, accounts, and networks you are authorized to test. The active chains can change the robot's WiFi configuration, stop or restart services, crash...