cve-2021-41773-v-

Apache httpd RCE A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside these directories are not protected by default...

CVE-2023-46954

CVE-2023-46954 SQL Injection vulnerability in Relativity Server 2022 v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the name parameter. Vulnerability Type SQL Injection Vendor of Product Relativity ODA LLC Affected Product Code Base Relativity Server 2022...

CVE-2021-24499

CVE-2021-24499 Mass exploitation of CVE-2021-24499 unauthenticated upload leading to remote code execution in Workreap theme. The AJAX actions workreapawardtempfileuploader and workreaptempfileuploader did not perform nonce checks, or validate that the request is from a valid user in any other wa...

git_rce

CVE-2024-32002: Explotando RCE en Git mediante git clone Este repositorio contiene un PoC para explotar CVE-2024-32002, una vulnerabilidad en Git que permite RCE durante una operación de git clone. Al crear repositorios con submódulos de una forma específica, un atacante puede explotar el manejo ...

CVE-2025-49132

Impact Using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code, without being authenticated. With the ability to execute arbitrary code, this vulnerability can be exploited in an infinite number of ways. It could be used t...

CVE-2018-5353

CVE-2018-5353 Zoho ManageEngine ADSelfServicePlus Client Privilege Escalation/RCE Information Vendor: Zohocorp Product: ManageEngine ADSelfServicePlus Versions Affected: Before 5.5 build 5517 Researcher: Jason Juntunen aka @missing0x00 https://github.com/missing0x00 CVSS: 8.8 Description The cust...

CVE-2022-24715

Icinga Web 2 - Ejecución remota de código autenticada 2.8.6, 2.9.6, 2.10 Ejecución remota de comandos Shell inversa Uso usage: exploit.py -h -u URL -U USER -P PASSWORD -i IP -p PORT Welcome. options: -h, --help show this help message and exit -u URL, --url URL Insert URL http://ipvictima -U USER,...

CVE-2024-4577

CVE-2024-4577 This is a PoC for PHP CVE-2024-4577. Introduction Security in the digital environment is more important than ever. That said, imagine an invisible door opens on millions of websites due to a new vulnerability in PHP, one of the most used programming languages ​​on the web. This...

CVE-2026-108768

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-5817-PoC

CVE-2026-5817: Docker Model Runner container-to-host RCE / Escape Any container on a Docker Desktop 4.40.0 to 4.67.x host can run code on the host with two HTTP requests. No socket mount, no --privileged, no caps. How Every container can reach Model Runner at model-runner.docker.internal with no...

CVE-2023-43208-PoC

Mirth Connect RCE Exploit CVE-2023-43208 This script is a Proof of Concept PoC for the Remote Code Execution RCE vulnerability in Mirth Connect versions prior to 4.4.1. It exploits an XStream deserialization vulnerability through the API. Requirements Python 3.10 or higher Compatible with 3.13...

struts-s2-052-deserialization-rce-lab

Apache Struts S2-052 XML Deserialization RCE This repository demonstrates exploitation of Apache Struts S2-052 CVE-2017-9805 using malicious XML deserialization. The exploit was developed while solving the INE eWPTX Practice Range – Struts XML Deserialization RCE lab. Vulnerability Overview Apach...

MetabaseRCE_CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 PoC A proof of concept of CVE-2023-38646, a Metabase exploit that allows user to do Remote Code Execution utilizing the setup token found in /api/session/properties to send a payload encoded in base64 Usage ./MetabaseRCECVE-2023-38646 -u target url -t target...

CVE-2024-9707

CVE-2024-9707 Hunk Companion = 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation Description The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the...

lab-cve-2025-57819

Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi → RCE Chain Nuclei POC Spin up a reproducible FreePBX 15 lab Docker to validate CVE-2025-57819 — a critical unauthenticated SQL injection in userman AJAX endpoints that can be chained to RCE. Includes a working Nuclei template...

RedArrow

RedArrow3.2 - ThinkPHP 5.0.23 Remote Command Execution Tool User Guide 1. Tool Introduction RedArrow3.2 is a graphical tool for the ThinkPHP 5.0.23 remote command execution vulnerability, providing two main functions: single command execution and an interactive GodzillaShell-like interface. This...

CVE-2024-23897-Vulnerabilidad-Jenkins

Exploitation of Vulnerability CVE-2024-23897 in Jenkins Vulnerability Description: CVE-2024-23897 CVE-2024-23897 is a critical vulnerability discovered in Jenkins, a popular continuous integration tool. This vulnerability allows remote command execution RCE on the Jenkins server due to a lack of...

CVE-2014-6271

🚨 CVE-2014-6271 — “Shellshock” 25-Year Zero-Day Remote Code Execution in GNU Bash via Environment Variables 📖 Overview CVE-2014-6271 , nicknamed Shellshock also known as Bashdoor, is a critical remote code execution RCE vulnerability in the GNU Bash shell. An attacker can send specially crafted...

CVE-2025-49113-Roundcube-RCE

CVE-2025-49113 — Roundcube Post-Auth RCE via PHP Object Deserialization Overview Field| Details ---|--- CVE| CVE-2025-49113 Software| Roundcube Webmail Affected Versions| ≤ 1.6.10 Vulnerability| PHP object deserialization → RCE Authentication| Required any valid user Impact| Remote Code Execution...

CVE-2011-2523-exploit

CVE-2011-2523 Exploit vsFTPd 2.3.4 Backdoor This project demonstrates exploitation of the vsFTPd 2.3.4 backdoor vulnerability CVE-2011-2523 using Python and pwntools. Disclaimer: This project is for educational and authorized penetration testing purposes only. Do NOT use against systems without...