CVE-2023-20887

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://kushagraojha.medium.com/vmware-vrealize-network-insight-cve-2023-20887-193f3c3d30a0...

CVE-2025-1974

Exploit for Ingress NGINX - IngressNightmare This project provides an exploit targeting critical unauthenticated Remote Code Execution RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare. In the original research, the Wiz team did not...

CVE-2021-30461

Impacted Products VoIPmonitor 24.60 How to RCE python3 CVE-2021-30461.py -t ipaddress Browser shell: http://x.x.x.x/namrlblgel.php?a=whoami Reference https://ssd-disclosure.com/ssd-advisory-voipmonitor-unauth-rce/...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE Proof-of-concept exploit for CVE-2026-48908 , a critical CVSS 4.0 = 10.0 unauthenticated remote-code-execution vulnerability in the SP Page Builder component comsppagebuilder for Joomla, by JoomShaper. | ---|--- CVE| CVE-2026-48908...

wp-cve-2026-63030-check

wp2shell-check Non-intrusive exposure checker for the WordPress "wp2shell" pre-authentication RCE chain CVE-2026-63030 + CVE-2026-60137. ⚠️ Authorized use only. Run this only against WordPress instances you own or have explicit permission to test. It is a triage aid, not an exploit. Scanning...

CVE-2023-5360

CVE-2023-5360 An Open-source EXPLOIT for The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. Table of Contents Introduction Features Usage...

CVE-2025-47812

🚀 Wing FTP Exploit - CVE-2025-47812 Enhanced exploit for Wing FTP Server CVE-2025-47812 - Unauthenticated Remote Code Execution RCE 🔧 Installation Clone this repository and enter the directory: git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 pip install -r...

CVE-2026-60137_CVE-2026-63030

CVE-2026-60137 + CVE-2026-63030 — WordPress Unauthenticated RCE Vulnerability: REST Batch Route Confusion + WPQuery SQL Injection → Full RCE CVSS v3.1: 10.0 / 10.0 — CRITICAL | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Affected: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 | Patched: 6.9.5, 7.0.2 Zero credential...

CVE-2022-41840-PoC

Zenario CMS 9.3 - Unauthenticated RCE Exploit CVE-2022-41840 An unauthenticated remote code execution RCE vulnerability affecting Zenario CMS version 9.3 and earlier. The exploit leverages a file upload vulnerability in the AJAX endpoint to upload a PHP webshell and achieve code execution...

htb-sau-exploit-chain

HTB Sau Exploit Chain — CVE-2023-27163 SSRF + Maltrail RCE Automation A Python exploit script that chains CVE-2023-27163 Server-Side Request Forgery in Request Baskets ≤ 1.2.1 with an unauthenticated Remote Code Execution vulnerability in Maltrail 0.53, delivering a reverse shell. Designed for th...

cve-2025-0364

CVE-2025-0364: BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE The BigAntSoft BigAnt Server, which provides a Windows hosted on-premises chat server that focuses on business use cases, is vulnerable to unauthenticated remote code execution via account registration and PHP...

dell-emc_recoverpoint

Dell EMC RecoverPoint Exploits for an enterprise data protection platform I have discovered the following vulnerabilities in the RecoverPoint enterprise data protection platform, mentioned in Dell EMC's disclosure. http://seclists.org/fulldisclosure/2018/May/61 Critical unauthenticated remote cod...

CVE-2026-54390

CVE-2026-54390 — JTL Shop Smarty SSTI Mass Exploit Pre-Auth Contact Form → Email Subject → fetch'string:' → RCE Overview CVE-2026-54390 is a critical CVSS 9.8 unauthenticated Server-Side Template Injection in JTL Shop 5.2.0–5.7.1. The SmartyRenderer::renderTemplate method passes email subject lin...

hikvision-unauthenticated-rce-cve-2021-36260

Hikvision CVE-2021-36260 RCE Vulnerability Vulnerability Description An attacker can use this vulnerability to gain complete control of the device with an unrestricted root shell, even if the device owner is limited to a restricted protected shell psh. In addition to compromising IP cameras, they...

CVE-2024-45590-PoC

CVE-2024-45590 - WordPress Plugin RCE PoC Vulnerability Details - CVE: CVE-2024-45590 - CVSS: 9.8 Critical - Type: Unauthenticated RCE via Arbitrary File Upload - Affected: WordPress Plugin Proof of Concept Demonstrates safe RCE exploitation with two commands: 1. id - Command execution proof 2...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2025-59287-WSUS

CVE-2025-59287-WSUS powershell version of hawktrace POC exploit https://hawktrace.com/blog/CVE-2025-59287-UNAUTH 1: edit the variables in the script url, port, etc 2: start netcat listener 3: run script - it will auto download ysoserial.net, generate the payload and send exploit to WSUS server th...

CVE-2019-9978

CVE-2019-9978 CVE-2019-9978 - PoC RCE in Social WarFare Plugin system'cat /etc/passwd' Save it with filename: payload.txt and upload it on a server. The URI should look like: https://yoursite.com/payload.txt. Finally, supply your --target and --payload-uri options: $ python cve-2019-9978.py...

mcpjaminspector-unauth-rce

mcpjaminspector-unauth-rce CVE-2026-23744 RCE in MCPJam inspector = 1.4.2 Vulnerability details https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6 Usage usage: mcpjaminspector-unauth-rce.py -h --target TARGET --command COMMAND options: -h, --help show this help message an...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Overview CVE-2026-33017 is an unauthenticated Remote Code Execution RCE vulnerability in Langflow versions This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this too...