CVE-2025-27636-RCE-in-Apache-Camel

CVE-2025-27636 – Apache Camel RCE Simple Python exploit for the Apache Camel header injection RCE CVE-2025-27636. Usage One-shot command execution ┌──root㉿user-/run/…/user/2024/HTBox/CVE-2025-27636 └─ python3 CVE-2025-27636.py -t http://192.168.159.120 -c "id" Executing: id uid=0root gid=0root...

CyberhawksLab-telnetCVE

CyberHawks lab demo finding report Credit to: @SafeBreach-Labs CVE: CVE-2026-24061 Lab: Cyberhawks Lab Target: 10.1.1.1 demo.cyberhawks.lab Finding ID: WU-08 Date: 2026-09-08 Severity: Critical Status: Confirmed / Exploited Executive Summary During an assessment of the Cyberhawks lab environment,...

CVE-2024-2961-XXE-Exploit

CVE-2024-2961 CNEXT XXE Channel Adaptation Exploit Script Adapts the PHP file-read - RCE exploit script from Ambionics' official cnext-exploits to the SVG upload + XXE arbitrary file read scenario PolarisCTF 2026 "Avatar Uploader" type challenges. Prerequisites Target: Linux + glibc update...

CVE-2026-30225-OliveTin-RCE

OliveTin — unauthenticated action execution → RCE + CVE-2026-30225 PoC for privilege escalation / remote code execution against OliveTin instances that run with the shipped guest defaults. Verified against OliveTin 3000.10.0 running as root HTB: Enigma, where it yields an unauthenticated root...

CVE-2026-67401

cve-id Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha Bopha...

stylesmuggler-ioc-toolkit

StyleSmuggler IOC Toolkit — CVE-2026-75650 Magento zero-day · Adobe Commerce zero-day · CVE-2026-75650 · APSB26-146 · VULN-39341 · unauthenticated RCE · Magento malware · Magento backdoor removal · Magento 2.4.9 vulnerability · Rust implant · GraphQL styles injection · PHP web shell Community...

CVE-2025-58434

CVE-2025-58434 - Flowise unauthenticated account takeover, chained to CustomMCP RCE Two Flowise 3.0.5 issues, chained: 1. CVE-2025-58434 - password-reset token disclosure. POST /api/v1/account/forgot-password returns the target user's tempToken directly in the JSON response. Feed it to POST...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injection → RCE PoC for remote code execution inOpenSTAManager ≤ 2.10.1. oauth2.php looks up a zzoauth2 row by the attacker-controlled state GET parameter and calls unserialize on its accesstoken column without anallowedclasses restriction...

EUVD-2026-44641

PraisonAI: Call API localhost-only authentication bypass via spoofed Host header...

CVE-2026-82222

⚡ GHOSTLYR00T - GiveWP RCE Exploit Framework CVE-2026-82222 - GiveWP Unauthenticated RCE Exploit Mass Scanner + Auto-Detection + Multi-Threading + Interactive Shell 📋 Daftar Isi | Table of Contents Overview Fitur Utama | Key Features Vulnerability Details Instalasi | Installation Parameter Lengka...

POC-CVE-2026-0769

Description Proof of concept exploit code for CVE-2026-0769 Usage python3 poc.py -u -c Without bash command proof of code exec via Divide By Zero Error With bash command NOTE: Bash output isn't returned because the endpoint only returns the component template and metadata. The bash output is stor...

POC-CVE-2026-0768

Description Proof of concept exploit code for CVE-2026-0768 Usage python3 poc.py -u -c...

SmarterMail-CVE-2026-24423

SmarterMail ConnectToHub RCE A Python-based exploit for CVE-2026-24423 , an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's ConnectToHub functionality. Intended use: Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only...

cve-2025-55182

Penetration Testing Writeup: Next.js RCE & Node.js Inspector Privilege Escalation This technical writeup details the exploitation path for compromising a target hosting a vulnerable Next.js web application, achieving initial access via harvested credentials, and leveraging a misconfigured local...

POC-CVE-2026-5027

Description Proof of concept exploit code for CVE-2026-5027 Usage python3 poc.py -u -c -a "bash command arg File written to Docker container disk...

yaml-payload-2

yaml-payload A SnakeYAML deserialization exploit payload for CVE-2022-1471 , adapted from artsploit/yaml-payload originally based on mbechler/marshalsec. What it does When loaded via SnakeYAML's unsafe Yaml.load, this payload takes over the running application and replaces it with a "You've Been...

CVE-2026-33017

CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview CVE-2025-62593 is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine. The root cause is the absence of authentication on critical HTTP endpoints /api/jobs, /api/jobagent/jobs. An attacker can...

hacktivity-vulns-exploits-lab

Vulnerabilities, Exploits, and Remote Access Payloads — lab writeup My walkthrough and analysis of the Hacktivity Cyber Security Labs sheet "Vulnerabilities, Exploits, and Remote Access Payloads" Ethical Hacking and Penetration Testing course, Leeds Beckett University. It covers how software...

Project-CVE-2026-75604

Next.js Windows Cache Traversal Security Research Defensive security research and authorized validation only. This repository concerns CVE-2026-75604 , a critical vulnerability that may permit unauthenticated remote code execution on certain Windows-hosted Next.js deployments. Credits Coded by:...

Project-CVE-2026-33017

CVE-2026-33017 Langflow Script — Code Explanation coded by: Xer0TLabs x Persephrak Decentralized Syndicate Purpose of this document This document is a high-level explanation of the supplied Python program for review, incident-response, and defensive analysis. It intentionally does not include...