CVE-2026-90502

A stored cross-site scripting (XSS) vulnerability was identified in stilleshan ServerStatus 1.0 and 2.0 . The flaw exists in the Stats Generation component (file server/src/main.cpp) and is triggered by manipulating the custom argument . The attack can be initiated remotely , requires low privile...

EUVD-2026-76975

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2024-24919-Sniper

CVE-2024-24919-Sniper Overview CVE-2024-24919 Sniper is a Python script designed to scan for Check Point Security Gateway Information Disclosure vulnerabilities. This script can perform both single-target and bulk scanning, utilizing multithreading to improve scanning speed. It supports various...

cve-2026-42945

CVE-2026-42945 — NGINX Rewrite Heap Overrun: Analysis, DoS & Credited RCE Port Security research on CVE-2026-42945 CVSS 4.0 9.2 CRITICAL: a heap buffer overrun in NGINX's script engine where a rewrite with arguments in the replacement e.g. rewrite ^. /new?c=1; leaves the engine's isargs flag set...

CVE-2024-49113

LDAP Nightmare An exploit for CVE-2024-49113 reported by Yuki Chen @guhe120. A vulnerability in Windows Lightweight Directory Access Protocol LDAP. Created by SafeBreach Labs published on January 1st 2025. For the full technical analysis of the vulnerability and how we managed to exploit it check...

CVE-2023-24489-ShareFile

ShareFile RCE CVE-2023-24489 Este es un script en Python que explota una vulnerabilidad de ejecución remota de código en la aplicación ShareFile CVE-2023-24489. Esta vulnerabilidad permite a un atacante ejecutar comandos arbitrarios en el sistema objetivo. Uso Para usar el script, siga las...

CVE-2019-16278-Nostromo-1.9.6-RCE

CVE-2019-16278-Nostromo-1.9.6-RCE This repository contains an exploit for CVE-2019-16278 in Nostromo Web Server 1.9.6, allowing remote code execution via a directory traversal vulnerability. The script uses pwntools to establish a reverse shell. For educational and authorized testing use only...

redis-poc

Redis Authenticated RCE stream NACK double free, TDigest & TopK module bugs Non-destructive RCE exploits for Redis 6.2.22, 7.4.9, 8.6.4 via the stream consumer-group shared-NACK double free a patch bypass of CVE-2026-25243, 8.8.0 via a TDigest heap-overflow in bundled RedisBloom, and 8.8.1 via a...

cve-2025-55182-node

CVE-2025-55182 Herramienta de Explotación RCE para Next.js Documento en chino | Análisis de la vulnerabilidad !CAUTION ⚠️ AVISO - LEA ANTES DE USAR Esta herramienta está destinada SOLO para: Investigadores de seguridad realizando verificación de vulnerabilidades Pruebas de penetración autorizadas...

chakra-exploit-framework

Chakra Exploitation Framework This repository contains the Browser Exploitation Framework I wrote to prepare for my EXP-401 course. The framework targets the Chakra engine, which was part of Edge until its switch to v8 in 2019. The demo vulnerability used in the framework is the CVE-2019-0567 Typ...

CVE-2025-57819-poc

CVE-2025-57819 — FreePBX Unauthenticated SQLi → RCE One-shot exploit for the FreePBX Endpoint Manager unauthenticated SQL injection CVE-2025-57819, chained into remote code execution via the FreePBX cronjobs table. For authorized security testing / CTF use only. Vulnerability The endpoint module'...

CVE-2026-44262

dedoc/scramble RCE CVE-2026-44262 PoC 📜 Description CVE-2026-44262 is an unauthenticated Remote Code Execution vulnerability in dedoc/scramble, a Laravel API documentation generator. NodeRulesEvaluator::doEvaluateExpression calls extract$variables before . When a controller assigns to a variable...

CVE-2025-55182-poc-tool

CVE-2025-55182-poc-tool A powerful exploit tool for detecting and exploiting CVE-2025-55182 vulnerability in Next.js React Server Components. This tool allows remote command execution RCE in vulnerable Next.js applications with built-in WAF bypass capabilities. Overview CVE-2025-55182 is a critic...

spring4shell-poc

Spring4Shell POC Description of the vulnerability: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construction of the POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Steps to Build/Run Tested with JDK 11.0.14, Spring Boot 2.6.5, and Apache Tomcat 9.0.60 Run...

spring4shell-poc

Spring4Shell POC Descripción de la vulnerabilidad: https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html Construcción del POC: https://github.com/BobTheShoplifter/Spring4Shell-POC Pasos para construir/ejecutar Probado con JDK 11.0.14, Spring Boot 2.6.5 y Apache Tomcat 9.0.6...

NextRce

NextRce - Herramienta de Explotación RSC de Next.js CVE-2025-55182 Escáner y Explotador Avanzado de Vulnerabilidades para Next.js App Router Desarrollado porMitsec 🔥 Nueva Funcionalidad: Modo de Omisión de WAF UTF-16LE Los payloads estándar que contienen palabras clave como childprocess o execSyn...

tc_hack

Esta herramienta utiliza una vulnerabilidad en Apache Tomcat llamada CVE 2017 12617 para obtener acceso remoto a cualquier servidor con el método PUT habilitado. Se puede descargar aquí deberá ejecutarlo desde la línea de comandos Uso: tchack target IP target port...

CVE-2025-24813

CVE-2025-24813 - Exploit de Ejecución Remota de Código en Apache Tomcat Este es un exploit de prueba de concepto PoC para CVE-2025-24813 , una vulnerabilidad en Apache Tomcat 9.0.80–9.0.83, 10.1.0–10.1.17 que permite la ejecución remota de código RCE mediante deserialización de sesión. El exploit...

CVE-2020-7931

CVE-2020-7931: SSTI exploitation in Artifactory Pro CVE-2020-7931 is somewhat of a purposeful misconfiguration vulnerability in Artifactory that lets attackers conduct server-side template injections from a FreeMarker template. The vulnerability was discovered by Ryan Hanson from Atredis and was...

CVE-2025-59287-PoC

CVE-2025-59287 / CVE-2023-35317 PoC Dentro de CVE-2025-59287: SoapFormatter RCE en WSUS: https://shellcode.blog/wsus-cve-2025-59287-investigation/ Este software ha sido creado únicamente con fines de investigación académica y para el desarrollo de técnicas defensivas efectivas, y no está destinad...