CVE-2025-49113

CVE-2025-49113 – Roundcube Webmail RCE Exploit Python PoC CVE ID: CVE-2025-49113 Exploit Type: Remote Code Execution via PHP Object Injection Application: Roundcube Webmail ≤ 1.5.9 and ≤ 1.6.10 Exploit Language: Python Author: 00xCanelo Status: Tested and Working on Vulnerable Roundcube...

0xKern3lCrush

0xKern3lCrush Windows BYOVD research on two real cases: the Safetica ProcessMonitorDriver CVE-2026-0828 and the ThrottleStop driver abused by MedusaLocker CVE-2025-7771. The repository documents the exposed interfaces, the privileged outcome each one reaches, and how to detect the abuse. It ships...

CVE-2021-41773

CVE-2021-41773 Reproduction https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited v2.4.49 Apache unique vulnerability, earlier versions do not have the apnormalizepath function. This function was introduced in v2.4.49, and it is exactly this function...

CVE-2026-67276

CVE-2026-67276 Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every donation is contributed to Kantha...

XploitSPY

A cloud based Android Monitoring Tool, powered by NodeJS Features GPS Logging Microphone Recording View Contacts SMS Logs Send SMS Call Logs View Installed Apps View Stub Permissions Live Clipboard Logging Live Notification Logging WhatsApp, Facebook, Instagram, Gmail and more .... View WiFi...

wp2shell

CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core REST API batch route confusion CVE-2026-63030 chained with a WPQuery authornotin SQL injection CVE-2026-60137 → pre-auth remote code execution against a default WordPress install. Discovered by Adam Kues Assetnote...

zygote-injection-toolkit

Zygote injection toolkit This is a Python command-line utility to easily run and backup private app data using the Android Zygote injection vulnerability CVE-2024-31317. To run this, you must have any device that has not been updated to the June 1, 2024 security patch. If you don't know whether...

CVE-2023-41772

CVE-2023-41772 / UIFuckUp UIFuckUp exploit to gain system privileges as user on Windows 10 1809 and up and 11. How To: 1. Compile uiaccessexploit.exe and uiaccessexploit.dll 2. Create directory C:\exploit 3. Place uiaccessexploit.exe, uiaccessexploit.dll and JuciyPotatoNG.exe in C:\exploit 4. Run...

CVE-2022-1388

CVE-2022-1388 Poc:pocsuite -r CVE-2022-1388F5BIG-IPPOCEXP.py -u url Exp:pocsuite -r CVE-2022-1388F5BIG-IPPOCEXP.py -u url --attack --command command 免责声明 此工具仅用于学习、研究和自查。不应将其用于非法目的。使用本工具产生的一切风险与我无关！ Disclaimer This tool is for study, research, and self-examination only. It should not be used for...

CVE-2026-39987

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

CVE-2019-11043

CVE-2019-11043 PHP-FPM Remote Code Execution Screencast: https://youtu.be/d6benC5FVZM Overview This zero-day exploit in common PHP-FPM configurations was discovered during the Realworld CTF competition in 2019. A regular expression is used to parse the requested URI, but newline characters %0a ar...

cve-2023-23397

CVE-2023-23397 This script allows to create TNEF-encoded Outlook e-mails with CVE-2023-23397 exploit payload and send them via pure SMTP - no need in COM objects or EWS. I could not get IPM.Schedule.Meeting.Request message class to work properly it generates both meeting and the reminder but does...

CVE-2022-22947

SpringCloud-Gateway Command Execution Vulnerability CVE-2022-22947 Environment Setup Method 1: Clone the ready environment code from GitHub. GitHub Repository //⚠️Note: The environment code download path must not contain Chinese characters or spaces git clone...

MetabaseRceTools

MetabaseRceTools CVE-2023-38646 Metabase RCE Tool CVE-2023-38646 RCE Graphical Exploitation Tool Verification Module Input the specified URL to detect unauthorized token Command Execution This module requires executing the verification module to obtain a token first JarLocation: the location of...

usbpcap

USBPcap - USB Packet capture for Windows End-user installer is available at: http://desowin.org/usbpcap Following informations are intended for developers and power users only. Directory overview: USBPcapCMD - sample user space application USBPcapDriver - filter driver used to capture data Build...

professional-services

Professional Services Common solutions and tools developed by Google Cloud's Professional Services team. Disclaimer This repository and its contents are not an officially supported Google product. License All solutions within this repository are provided under the Apache 2.0 license. Please see t...

pwnproxy

CI: suite · goldens · perf-check — baseline 281.9ms / 19 pages tests/perf/baseline.json — .github/workflows/ci.yml pwnproxy One security testing engine. Every interface. An open, local-first security testing platform for pentesters, AI agents, CI/CD pipelines, and teams. Security testing is no...

cve-2020-0688

cve-2020-0688 I made this script for conducting CVE-2020-0688 more rapidly. It helps to improve checking the vuln, reducing hugely steps for that. Modify these inputs before running the file. url = "https://mail.something.com" input 1 command = "cmd /c echo OOOPS!!! c:/truongtn.txt" input2...

CVE-2020-14882

CVE-2020–14882 Weblogic Unauthorized bypass RCE bypass patch with CVE-2020–14882 private static final String IllegalUrl = new String";", "%252E%252E", "%2E%2E", "..", "%3C", "%3E", ""; list %252E%252E %2E%2E .. %3E %3C ; lower "%252E%252E%252F".lower '%252e%252e%252f' %252E%252E%252F to...

k0otkit

k0otkit - Manipulate K8s in a K8s way Introduction k0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters. With k0otkit, you can manipulate all the nodes in the target Kubernetes cluster in a rapid, covert and continuous way reverse shell...