CVE-2024-44871

MoziloCMS = 3.0.1 Authenticated RCE Description This script is an exploit tool designed for testing web applications running MoziloCMS. It allows an attacker to use admin logins to upload a PHP web shell via jpg file, rename the uploaded file to php, and send system commands to the target through...

CVE-2025-21385

SSRF Exploit Script This repository contains a script designed to perform an SSRF Server-Side Request Forgery exploit for testing and educational purposes. Use this tool responsibly and only in environments where you have explicit permission. Features Exploit SSRF vulnerabilities in target system...

cve-2026-0770-langflow_rce_reproduction

CVE-2026-0770: Langflow execglobals Remote Code Execution CVSS 9.8 Critical | ZDI-CAN-27325 | CWE-829: Inclusion of Functionality from Untrusted Control Sphere Overview CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in Langflow, a low-code application framework fo...

CVE-2022-31814

CVE-2022-31814 Reworked and optimized exploit script of pfBlockerNG 2.1.426 vulnerability Exploit Title: pfBlockerNG 2.1.426 - Remote Code Execution RCE Shodan Results: https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22 Dat...

CVE-2026-12513

CVE-2026-12513: Shared Files 1.7.68 — Unauthenticated Arbitrary File Deletion via Path Traversal 📖 Advisory Overview CVE-2026-12513 is an unauthenticated Arbitrary File Deletion vulnerability via Path Traversal affecting the Shared Files and Shared Files Pro WordPress plugins before version 1.7.6...

CVE-2022-22947-POC

CVE-2022-22947-POC CVE-2022-22947 batch detection script. The echo command is not regex-filtered. Please use it for now; I will update later. Place url.txt in the script directory. Directly run: python 脚本.py Demo: After the scan is complete, a success.txt file will be generated. This script will...

cve-2021-4034-mock

CVE-2021-4034 PwnKit Mock Vulnerability System This project is a mock system that reproduces the core operating principles of CVE-2021-4034 Out-of-Bounds Read/Write vulnerability in the Linux pkexec daemon. Without actual SUID privilege escalation, it safely simulates the mechanism of environment...

CVE-2025-24813-Apache-Tomcat-RCE-PoC

CVE-2025-24813 Apache Tomcat RCE PoC Description This is a Proof of Concept PoC for CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. The vulnerability arises from unsafe deserialization of crafted session files uploaded via HTTP PUT requests, allowing attackers to execu...

CVE-2025-66478-PoC-Reverse-Shell

CVE-2025-66478 / CVE-2025-55182 "React2Shell" — RSC Server Actions Deserialization RCE PoC Proof-of-concept exploit for CVE-2025-55182 — publicly nicknamed "React2Shell" — a server-side prototype pollution vulnerability in React Server Components' Server Actions deserialization...

cve-2019-16097

cve-2019-16097 1. Add the URLs you want to detect in urls.txt 2. Run the cve-2019-16097 script in python3 environment python3 cve-2019-16097.py 3. After batch detection is complete, view the URLs with successfully written accounts in results...

CVE-2025-49113-PoC

CVE-2025-49113 Roundcube RCE PoC 🚀 How to launch the project 1. Starting the vulnerable server cd Stand docker-compose up -d 2. Running the script against the target cd PoC/src python3 scanner.py --target http://localhost:9000 --username test --password test --command "id" 📌 Key Requirements...

CVE-2026-46587

camel-couchbase CCB Header Injection Reproducer CVE-2026-46587 This project demonstrates a message-header injection in Apache Camel's camel-couchbase component, tracked as CVE-2026-46587. The component reads several Exchange headers to control its behaviour — CCBKEY document key, CCBID document i...

CVE-2022-0540-RCE

Atlassian Jira Seraph Authentication Bypass RCE（CVE-2022-0540） English • 中文 Exploit Details As seen in author's blog, atlassian provided a long list of affected plugins the vast majority of which were false positives, and the author listed several actual affected plugins According to the prompted...

esp32_esp8266_attacks

ESP32/ESP8266 Wi-Fi Attacks This repository is part of a research outcome from theASSET Research Group. This repository demonstrates 3 Wi-Fi attacks against the popular ESP32/8266 IoT devices: Zero PMK Installation CVE-2019-12587 - Hijacking ESP32/ESP8266 clients connected to enterprise networks;...

EagleEye

EagleEye: With the addition of the -ss option in HTTPX by Project Discovery, it is now possible to create a list of potentially vulnerable URLs with gf xss and qsreplace with the XSS payload, such as alerthacked. HTTPX will then visit all the URLs and take screenshots of them, which are stored in...

Embedded-PDF

Embedded Backdoor Connection via PDF Files 😈 brought to you by Introduction This demonstration video shows how we can control the victim's device by sending the innocent-looking PDF file to the target which actually consists of embedded payload. The exploit was made public as CVE-2010-1240. As so...

CVE-2017-8759

Exploit tool CVE-2017-8759 Exploit tool CVE-2017-8759 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft .NET Framework RCE. It could generate a malicious RTF file and deliver metasploit / meterpreter / other payload to victim...

CVE-2026-48017

CVE-2026-48017 — Remote Code Execution in DbGate via functionName injection Severity : High CVSS 8.8 CWE : CWE-94 — Improper Control of Generation of Code 'Code Injection' Affected : dbgate-api ≤ 7.1.8 patched in 7.1.9 Advisory : GHSA-hv83-ggc4-v385 NVD :...

copyfailscan

copyfailscan Bash helper: discover hosts optional CIDR via nmap, then SSH read-only checks for CVE-2026-31431 Copy Fail / algifaead, CVE-2026-31677 / CVE-2026-43077 AFALG RX heuristics, CVE-2026-23111 nftables + user namespaces, CVE-2026-23102 arm64 SVE/SME. Heuristics only — not an exploit;...

CVE-2023-26469-Jorani

CVE-2023-26469 Exploitation Tool Overview This is a Proof of Concept PoC exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques. ⚠️ Warning: This tool is intended for security research and authorized testing only...