CVE-2020-5902

🚨 CVE-2020-5902 — F5 BIG-IP TMUI RCE CVE-2020-5902 is a critical unauthenticated Remote Code Execution RCE vulnerability in the F5 BIG-IP Traffic Management User Interface TMUI / Configuration utility. 📌 Overview Disclosed by F5 on June 30, 2020 NVD published July 1, 2020, this flaw allowed...

opentaint

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...

CVE-2025-32433

🚨 CVE-2025-32433: Unauthenticated RCE in Erlang/OTP SSH Server Critical Pre-Authentication Remote Code Execution Vulnerability A severe flaw in the Erlang/OTP built-in SSH daemon allows unauthenticated remote attackers to achieve full remote code execution RCE by sending crafted SSH connection...

Ascon.Pilot.WinService Auth Bypass Code Execution

The vulnerability of the Ascon.Pilot.WinService component in the Pilot-BIM data management system is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

TEN Framework - Arbitrary File Read & Write

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints, letting attackers read or write arbitrary files and execute code. The exploit requires no authentication. id: CVE-2026-85688 info: name: TEN Framework -...

Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

Apache Gravitino 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage. id: CVE-2026-41042 info: name: Apache Gravitino 1.2.1 -...

XWiki-Platform-RCE-CVE-2025-24893

XWiki Platform Unauthenticated RCE Exploit Overview This script is a refurbished Bash implementation of an exploit targeting the XWiki Platform versions affected by CVE-2025-24893. It leverages a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitra...

nginx-rift-private-lab

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This fork extends the original PoC with an ASLR-bypass...

CVE-2024-6366

To create a Metasploit module to exploit the RCE vulnerability in the User Profile Builder WordPress plugin before version 3.11.8, we need to take advantage of the lack of proper authorization in the media file upload functionality. Here is how you can create such a Metasploit module: Metasploit...

VisualDoor

VisualDoor SonicWall SSL-VPN Exploit, as used by Phineas Fisher to hack Cayman Trust Bank and Hacking Team. Unauthenticated, gives you a "nobody" shell. Getting root is an exercise for the user. For details see: https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/...

Apache-OFBiz-Exploit

Apache-OFBiz-Exploit Exploit for Apache OFBiz CVE-2024-38856 By: Alisson Faoli Description This repository contains an exploit for the CVE-2024-38856 vulnerability found in Apache OFBiz. The flaw allows Unauthenticated RCE Remote Code Execution. Note: This exploit is provided for educational and...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. Exploit Title:...

CVE-2022-20699

CVE-2022-20699 🎧 Brought to you by the Audiobahn Cisco Anyconnect VPN unauth RCE rwx stack it is not well checked...

CVE-2025-9074-PoC

Docker API Unauthenticated RCE CVE-2025-9074 A critical CVE-2025-9074 vulnerability in Docker Desktop enables locally running Linux containers to connect to the Docker Engine API through the default subnet 192.168.65.7:2375. The issue persists regardless of Enhanced Container Isolation ECI or TCP...

CVE-2025-53770

CVE-2025-53770 This is a multiple site scanner for CVE-2025-53770 Unauthenticated RCE Vulnerability. Other scanners/PoCs:- https://github.com/hazcod/CVE-2025-53770 https://github.com/MuhammadWaseem29/CVE-2025-53770 CVE-2025-53770 Sharepoint RCE Impact: Unauthenticated attackers can achieve remote...

CVE-2025-53770

CVE-2025-53770 – Microsoft SharePoint Server 2019 Unauthenticated RCE via Deserialization Exploit Author: Agampreet Singh Tool: RedRoot https://github.com/Agampreet-Singh/RedRoot Date: August 7, 2025 Tested On: SharePoint Server 2019 v16.0.10383.20020 on Windows Server 2019 CVE-ID: CVE-2025-53770...

CVE-2025-53770-SharePoint-Zero-Day-Variant-Exploited-for-Full-RCE

🚨 CVE‑2025‑53770 – SharePoint Zero-Day Variant Exploited for Full RCE A Critical Escalation from CVE‑2025‑49706 By Aditya Bhatt – Red Team | VAPT 📌 TL;DR CVE‑2025‑53770 is a critical CVSS 9.8 zero-auth RCE vulnerability in Microsoft SharePoint now actively exploited in the wild. This isn’t a...

CVE-2022-46169

CVE-2022-46169 This repository contains a Proof of Concept PoC for CVE-2022-46169 - Unauthenticated RCE on Cacti = 1.2.22. You can read more about the vulnerability here. The script adds a reverse shell handler and is based on the code written by sAsPeCt488. You can view the original code here...

CVE-2021-38647

CVE-2021-38647 CVE-2021-38647 - POC to exploit unauthenticated RCE OMIGOD on Azure UNIX/Linux VMs! Details In Microsoft's Azure, the OMI application gets installed automatically when services like Azure Automation Accounts, Update Management, Log Analytics, Configuration Management, etc., are use...