CVE-2026-23744

CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthenticated remote code execution PoC for CVE-2026-23744. MCPJam Inspector 1.4.2 and earlier expose functionality through /api/mcp/connect that can launch an attacker-controlled MCP server command without authentication. For authorized...

Golang-CVE-2021-44077-POC

Golang-CVE-2021-44077-POC This exploit is an unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus msiexec.exe Then, run the exploit. go run CVE-2021-44077.go -u "http://192.168.1.3:8080/" -f "/msiexec.exe" -u is the vulnerable URL -f is your malicious file...

CVE-2023-34362

CVE-2023-34362: MOVEit Transfer Unauthenticated RCE For a full technical description of the vulnerability and exploitation, please read our AttackerKB Analysis. Usage ruby CVE-2023-34362.rb Note: The deserialization gadget is configured to spawn 'notepad.exe'. Example ruby poc-cve-2023-34362.rb...

spip-cve-2023-27372-rce

SPIP CVE-2023-27372 Unauthenticated RCE Exploit Web Shell Upload This Python script exploits CVE-2023-27372, an unauthenticated remote code execution vulnerability in SPIP CMS versions prior to 4.2.1. It leverages a cache poisoning flaw in the password reset mechanism to upload a web shell and...

CVE-2019-13025

Connect Box CH7465LG CVE-2019-13025 Information This repository contains two PoCs for the Connect Box CH7465LG running on Firmware CH7465LG-NCIP-6.12.18.24-5p8-NOSH or older. For more information have a look at my blog. Usage Unauthenticated Remote Code Execution $ python3 poc-rce.py...

CVE-2022-46169

CVE 2022-46169 This script exploits an unauthenticated command injection vulnerability in Cacti versions through 1.2.22 in order to achieve unauthenticated remote code execution and gain a reverse shell...

CVE-2026-11834

CVE-2026-11834 PoC TP-Link DHCP Option 66 Unauthenticated RCE CVE-2026-11834 Overview A command injection vulnerability CWE-78 in the DHCP Option 66 "TFTP Server Name" handling of TP-Link router firmware allows an unauthenticated attacker on the same network segment to execute arbitrary commands ...

Vuln_Exploitation_MegaQuagga_Pentest

Vulnerability Exploitation — MegaQuagga Penetration Test Report Analyst: Samuel Weiss Organization: 0x2A Security Date: April 20, 2026 Client: MegaQuagga Publishing Target: www.megaquagga.local Classification: CONFIDENTIAL Overview This project documents a structured penetration test conducted...

cve-2026-58138

CVE-2026-58138: Conductor unauthenticated RCE Reproduction kit for CVE-2026-58138, a CVSS 9.8 code-injection vulnerability in Conductor. It contains the OpenTaint rule and GraalVM approximations, isolated rule tests, the scan result, and a working exploit. Read the case study Open the interactive...

CVE-2026-44277

🚨 CVE-2026-44277 - FortiAuthenticator Unauthenticated RCE Critical Unauthenticated Remote Code Execution in Fortinet FortiAuthenticator 📋 Overview CVE-2026-44277 is a critical vulnerability in Fortinet FortiAuthenticator that allows unauthenticated attackers to achieve Remote Code Execution RCE v...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Proof of Concept POC Just access the URL with your PHP code in "gridValoresPopHidden" parameter. Researches h...

CVE-2021-45232-RCE

CVE-2021-45232 CVE-2021-45232 Apache apisix Dashboard api unauth rce Version: 2.10.1 Fofa: title="Apache APISIX Dashboard" POC: IP:PORT/apisix/admin/migrate/export...

BigFinger

CVE-2023-46747 - Big-IP RCE Unauthenticated This is a Python3 script to exploit the unauthenticated remote code execution vulnerability CVE-2023-46747 in F5 BIG-IP appliances via the TMUI interface. Basically, if this vuln hits, you get a shell without credentials. Built with threading, file inpu...

CVE-2023-0669-Analysis

CVE-2023-0669 This Repo contain the pcakages and scripts used in this Analysis https://www.vicarius.io/vsociety/blog/unauthenticated-rce-in-goanywhere The vulnerable version of GoAnywhere for Linux https://www.dropbox.com/s/j31l8lgvapbopy3/ga703linuxx64.sh?dl=0...

Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress

Plugin Acyber Wordpress !WARNING Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 wp2shell کاهش مخاطره اضطراری و موقت برای زنجیره آسیب‌پذیری wp2shell 🇬🇧 English Description This lightweight WordPress plugin serves as a temporary virtual patch mitigation against the critical...

wp2shell-vulnerability-scanner

WP2Shell Scanner A read-only, non-destructive security audit tool that scans WordPress installations for the wp2shell vulnerability chain. Overview WP2Shell Scanner is a bash utility that recursively searches a directory tree for WordPress installations and checks whether each site is running a...

CVE-2026-55579

CVE-2026-55579 — Pheditor Hardcoded Default Password RCE -critical TL;DR: Pheditor all versions ships with a hardcoded default administrator password admin embedded in its source code. There is no forced password change on first login, only a visual warning. Any unauthenticated attacker can log i...

CVE-2026-9254

TP-Link Archer BE800 V1 — Parental Control LAN RCE CVE: CVE-2026-9254 CVSS: 8.7 High Auth required: None Network position: LAN only Found on version 1.3.2 Build 20251015 rel.106595553 Summary The parental control blocking endpoint /cgi-bin/luci/blocking?form=vercode is reachable from the LAN...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE Exploit Critical CVSS v4: 10.0 — Proof-of-concept exploit for unauthenticated remote code execution in SP Page Builder comsppagebuilder for Joomla. 📋 Vulnerability Overview Attribute| Value ---|--- CVE ID| CVE-2026-48908 Severity| Critic...

CVE-2026-58455-PoC

CVE-2026-58455 — Dockwatch Unauthenticated RCE auth bypass + command injection Proof-of-concept for CVE-2026-58455 : unauthenticated remote code execution in Dockwatch by Notifiarr, a self-hosted Docker container management web UI. Affects all versions through 0.6.567. Root cause verified from...