MetabaseRceTools

MetabaseRceTools CVE-2023-38646 Metabase RCE Tool CVE-2023-38646 RCE Graphical Exploitation Tool Verification Module Input the specified URL to detect unauthorized token Command Execution This module requires executing the verification module to obtain a token first JarLocation: the location of...

CVE-2022-22947

CVE-2022-22947 Memory Shell Injection Supports injection of three types of memory shells Usage: usage -t -u Options: -h, --help show this help message and exit -t TYPE switch one : spring, netty, godzilla -u URL url Taking Godzilla shell injection as an example python3 -t godzilla -u...

ForgottenButNotGone

Forgotten but Not Gone This repository contains proof-of-concept scripts for the vulnerabilities presented at the talk "Forgotten but Not Gone: Unauthenticated RCEs and LPEs in Legacy Linux Services" from Black Hat USA 2026 and DEF CON 34. CVE-2026-28372 Local privilege escalation in TelnetD:...

GL.iNet-Multiple-Vulnerabilities

GL.iNet Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2023-46454: In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality...

CVE-2026-34234-Lab

CVE-2026-34234 - CtrlPanel Installer RCE Lab Local Docker lab for demonstrating CVE-2026-34234 in CtrlPanel. This repository compares: vuln: CtrlPanel 1.1.1 pinned by digest patched: CtrlPanel 1.2.0 pinned by digest The lab is local-only and binds services to 127.0.0.1. Summary CVE-2026-34234 is ...

spring_cloud_gateway_memshell

CVE-2022-22947 memshell This script is incomplete, for learning purposes only, do not use illegally. Based on c0ny1 senior's blog, this is a learning script that can write netty and spring memory shells. Test environment is vulhub eg:xx.py http://127.0.0.1:8080 netty whoami...

CVE-2012-2982-Webmin-Exploit

Webmin 1.590 Remote Command Execution Exploit CVE-2012-2982 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2012-2982 , a remote authenticated command execution vulnerability affecting Webmin versions 1.590 and earlier. The vulnerability resides in the /file/show.cgi...

CVE-2025-20281-2-Cisco-ISE-RCE

CVE-2025-20281-2-Cisco-ISE-RCE Unauthenticated Python PoC for CVE-2025-20281 RCE against Cisco ISE API CVE-2025-20281 Unauthenticated PoC A minimal Python proof-of-concept that exploits the unauthenticated RCE in Cisco ISE’s ERS API CVE-2025-20281 by injecting arbitrary shell commands into the...

CVE-2024-36401-WoodpeckerPlugin

CVE-2024-36401-WoodpeckerPlugin Introduction Batch detection and exploitation of CVE-2024-36401, supporting custom memory shell injection 1. Batch detection capability 2. The backend has already filtered URLs just provide the URLs 3. Can custom generate memory shell for injection default memory...

CVE-2020-35713

Description Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page. How to use Step 1: Modify the IP address in cve-2020-35713.py file to the target address Step 2: Run the...

CVE-2020-15778

CVE-2020-15778 Introduction This repo reproduces CVE-2020-15778. Steps 1. Build the docker images for scp server and client cd client docker build -t client-cve . cd server docker build -t server-cve . 2. Spin up the scp server in container. docker run -d -P --name scp-server server-cve Retrieve...

vulnx

VulnX Vulnx 🕷️ は、複数種類のCMSの脆弱性を検出するインテリジェントボット自動シェルインジェクターです。 https://github.com/anouarbensaad/vulnx/archive/master.zip VulnX Wiki • 使い方 • 互換性 • ライブラリ • Vulnx は、複数種類のCMSの脆弱性を検出するインテリジェントボット自動シェルインジェクターです。高速なCMS検出、サブドメイン、IPアドレス、国、組織、タイムゾーン、地域、ANSなどのターゲット情報収集、脆弱性スキャンを行います。...

CVE-2020-7247

CVE-2020-7247 This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtpmailaddr” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user How to use? python3 getShell.py If you need a reverse shell then run it...

CVE-2020-16846-Saltstack-Salt-API

CVE-2020-16846-Saltstack-Salt-API Vulnerability Explained: An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. The details about this vulnerability can be found here:...

CVE-2019-15107

Webmin Server Management Tool RCE Vulnerability CVE-2019-15107 Summary CVE-2019-15107 is a vulnerability in Webmin, a web-based system administration tool for Unix systems. In the code that changes passwords, a specific parameter is passed directly to a shell command without filtering, allowing...

CVE-2015-3306-Home-Lab

ENGLISH BELOW ProFTPD 1.3.5 modcopy — RCE Simulation Lab Lab นี้ถูกออกแบบเพื่อจำลองช่องโหว่ CVE-2015-3306 — ProFTPD modcopy Remote File Copy to RCE ใช้สำหรับเรียนรู้ Web Shell Injection RCE ผ่านโมดูล modcopy ของ ProFTPD Features ProFTPD 1.3.5 แบบ Vulnerable เปิดใช้ modcopy เต็มรูปแบบ SITE CPFR /...

CVE-2025-47227_CVE-2025-47228

ScriptCase - 事前認証なしのリモートコマンド実行 管理者パスワードリセット（認証バイパス、CVE-2025-47227）とシェルインジェクション（認証済みリモートコマンド実行、CVE-2025-47228）の連鎖 事前認証なしのリモートコマンド実行は、2つの脆弱性を連鎖させることで実現されます。1つ目は、特定の条件下でプロダクションコンソールの管理者パスワードをリセットできること、2つ目は、ユーザー入力がsshシステムコマンドに直接連結される接続機能における単純な認証済みリモートコマンド実行です。 必要条件...

CVE-2025-10230

CVE-2025-10230: Samba Critical RCE CVSS 10.0 Vulnerability Summary CVE-2025-10230 is a critical remote code execution RCE vulnerability that remained hidden in the Samba codebase for 13 years. The flaw resides in the handling of WINS Windows Internet Name Service registration packets. When...

CVE-2026-104859

Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings. The release.docker.repositoryName and registryUrl...

CVE-2026-104859

The Nx monorepo solution for TypeScript and polyglot codebases is vulnerable to OS command injection in the @nx/docker release pipeline. In versions 21.4.0 until 22.7.8 and 23.0.0 until 23.1.1 , the release.docker.repositoryName and registryUrl configuration values are interpolated into shell com...