vulnerability_struts-2.3.31

vulnerabilitystruts-2.3.31 构建 struts-2.3.31 CVE-2017-5638 环境。 支持 HTTPS 请求。 环境 Ubuntu 20.04 Docker 20.10.12 curl 7.68.0 服务器启动 我们将使用 tomcat:7.0-jre8 docker 镜像。 在您选择的目录中解压 struts-2.3.31.zip。 cd struts-2.3.31 sudo docker build -t struts/2331 . sudo docker run -it --rm -p 8443:8443 struts/2331 测试请求 一（...

CVE-2024-23997

YANA Notebook PoC A Proof-Of-Concept for CVE-2024-23997 vulnerability. 1. Vunerability Overview: Vulnerability Subject: Local Code Excution via XSS Vulnerability Version: = 1.0.16 Attack Type: Remote Code Execution Attack Vectors: To exploit the vulnerability, we must intercept an HTTP packet...

CVE-2022-39196-

CVE-2022-39196 Black board CMS Escalation of Privileges Blackboard Learn version 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL. Additional Information Step 1: Use a student...

cve-2019-9978

cve-2019-9978 Este es un script que permite explotar la vulnerabilidad CVE-2019-9978 de manera directa, pensado para su uso en desafíos Capture The Flag CTF o como prueba de concepto para pruebas de penetración. Requisitos previos Python 3 Librería Requests Instalar con pip install requests Uso 1...

file-away-exploit

File-Away Exploit CVE-2025-2539 & CVE-2025-2512 📌 Purpose This repository contains vulnerabilities details and scripts found on File-Away, which is a WordPress plugin used to file management. This plugin contains two vulnerabilities that can lead to remote code execution Tested on File-Away...

CVE-2025-23266

CVE-2025-23266 Author: Mark Mallia Target platform: Ubuntu 22.04, FastAPI v2.4.3 → patched to v2.5.1 on 2025‑10‑02 1 – In a nutshell: what does this attack involve FastAPI’s parserequest routine copies HTTP request headers into a small buffer that lives on the caller’s stack. If an attacker sends...

Project-Exploiting-CVE-2024-27198-RCE-Vulnerability

Explotando la vulnerabilidad CVE-2024-27198-RCE En este proyecto, exploté la vulnerabilidad CVE-2024-27198-RCE para realizar un ataque de ejecución remota de código RCE en un servidor TeamCity vulnerable. La vulnerabilidad permite cargar y activar un plugin malicioso que proporciona acceso al...

CVE-2022-24715

CVE-2022-24715 Icinga Web 2 - Authenticated Remote Code Execution 2.8.6, 2.9.6, 2.10 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

CVE-2024-30973

CVE-2024-30973 - V-SOL G/EPON ONU - HG323AC-B Elemento de Descripción: Item: G/EPON ONU Specification: HG323AC-B Device model XPON+2GE+1POTS+2WIFI+USB Device SN 70B64F-1234570B64F0C2C0C Hardware Version V1.0 Firmware Version V2.0.08-210715 PON S/N GPON000C2C0C Tipo de Vulnerabilidad:...

CVE-2023-23752

安装 git clone https://github.com/0xx01/CVE-2023-23752.git cd CVE-2023-23752 chmod +x exploit.sh 用法 ./exploit.sh http://localhost...

CVE-2019-25024

CVE-2019-25024 OpenRepeater ORP / Unauthenticated Command Injection Advisories: MITRE CVE: https://vulners.com/cve/CVE-2019-25024 US NIST: https://nvd.nist.gov/vuln/detail/CVE-2019-25024 Tenable: https://www.tenable.com/cve/CVE-2019-25024 VulDB: https://vuldb.com/?id.170172 Ubuntu:...

HTB_Nibbles

HTBNibbles En este repositorio encontrarás el informe técnico de Nibbles, el exploit pwned.py para abusar del CVE-2015-6967 y una herramienta autopwn autopwn.py en caso de que quieras resolver la máquina en HackTheBox. Pwned.py herramienta: Este archivo te ayudará a explotar CVE-2015-6967. Si...

CVE-2022-37208

37208 CVE-2022-37208 Descripción sugerida JFinal CMS 5.1.0 es vulnerable a inyección SQL. Estas interfaces no utilizan el mismo componente, ni tienen filtros, sino que cada una usa su propio método de concatenación SQL, lo que provoca inyección SQL. Información adicional...

CVE-2025-55182-RCE-Exploit

POC para CVE-2025-55182 – Ejecución Remota de Código en Next.js 16.0.6 Este repositorio contiene un proof-of-concept POC funcional para CVE-2025-55182 , una vulnerabilidad crítica de deserialización que afecta a Next.js 16.0.6. El exploit abusa de la deserialización de chunks $@ y de...

CVE-2024-25412

CVE-2024-25412 A cross-site scripting XSS vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field Vulnerability Type: Cross Site Scripting XSS Vendor of Product: https://github.com/flatpressblog/flatpress Affect...

CVE-2021-46703

CVE-2021-46703 Constructor simple de payload basado en el POC en: https://github.com/Antaris/RazorEngine/issues/585 Uso C dotnet build --configuration Release .\bin\Release\net4.8\Poc.exe "System.IO.File.WriteAllText"rce.txt", "Hello World";" Python ./poc.py...

log4j-rce-CVE-2021-44228

Resumen Este es un proyecto para probar la vulnerabilidad de ejecución remota de código de log4j2 CVE-2021-44228. Iniciar los contenedores docker-compose up El contenedor log4j tarda un poco en estar listo después de iniciarse. Verifique el progreso con el siguiente comando: docker logs -f log4j...

l4s-vulnapp

Log4Shell Vulnerable Applicationl4s-vulnapp This is a potentially vulnerable Java web application containing Log4j2.14.1 affected by log4shellCVE-2021-44228. Verified environment and various versions AdoptOpenJDK 17.0.10+7 Gradle 8.6 Gretty 4.1.2 Apache Tomcat 10.1.15 Apache Log4j Core 2.14.1...

Poleposph

Poleposph Tools for scan CVE-2024-25600 - WordPress Bricks Builder Remote Code Execution RCE...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method RCE https://nvd.nist.gov/vuln/detail/CVE-2016-2098 Use git clone...