CVE-2024-42640

CVE-2024-42640 Unauthenticated Remote Code Execution via Angular-Base64-Upload Library CVE-2024-42640 Angular-base64-upload versions prior to v0.1.21 are vulnerable to unauthenticated remote code execution via the angular-base64-upload/demo/server.php endpoint. Exploiting this vulnerability allow...

CVE-2021-34371.jar

CVE-2021-34371.jar CVE-2021-34371.jar from https://github.com/vulhub/vulhub/tree/master/neo4j/CVE-2021-34371/rhinogadget USE EXP...

CVE-2025-32432-PoC

CVE-2025-32432 Exploit Scripts Python PoC Pre-auth Remote Code Execution for CraftCMS 3.x / 4.x / 5.x PoC Maintainer: C.T.Y. research use only Vulnerability Discovery: Nicolas Bourras – Orange Cyberdefense Additional PoC Inspiration: SensePost research & Chirag Artani’s public script 1. Overview...

Erlang-OTP-SSH-CVE-2025-32433

✅ Result The server responded to an SSH message ID 80 0x50 — which is reserved for post-auth. This proves the server accepts invalid messages during the pre-auth phase, indicating vulnerable behavior as defined in CVE-2025-32433. 📖 Research Summary I built this lab after studying Erlang/OTP and t...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors White Hat School 4th Cohort, Class 25 임두연@endusdksla Summary XWiki interprets wiki syntax and macros on the server side and renders them. The issue is that the Main.SolrSearch page is open to guests, yet it evaluates the user input...

CVE-2021-21972

CVE-2021-21972 Proof of Concept Exploit for vCenter CVE-2021-21972 Research credit to: https://swarm.ptsecurity.com/unauth-rce-vmware/, http://noahblog.360.cn/vcenter-6-5-7-0-rce-lou-dong-fen-xi/ Tested on both Windows and Unix vCenter VCSA targets. Usage To benignly check if the target is...

Rejetto-HFS-2.x-RCE-CVE-2024-23692

An unauth SSTI in the Rejetto HTTP File Server HFS. Original finder PoC: https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/ Tested against versions: 2.4.0 RC7, 2.3m Example usage: msf6 use exploit/windows/http/rejettohfsrcecve202423692 No payload configured, defaulting to...

CVE-2023-1671-POC

Dork fofa title="Sophos Web Appliance" || app="Sophos-Web-Appliance" && title!="Sophos Web Appliance：错误请求" ZoomEye title:"Sophos Web Appliance"-title:"Sophos Web Appliance: Forbidden"-title:"Sophos Web Appliance: Bad Request" Shodan title:"Sophos Web Appliance" Usage python CVE-2023-1671-POC.py -...

CVE-2019-16920-MassPwn3r

0day exploit for Multiple D-Link Routers Vulnerability was found in latest firmware of the following D-Link products: DIR-655 DIR-866L DIR-652 DHP-1565 Current Description Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue...

CVE-2026-9198

🚨 CVE-2026-9198 IBM Langflow OSS Unauthenticated RCE via Auto-Login Bypass 📋 Overview CVE-2026-9198 is a critical unauthenticated Remote Code Execution RCE vulnerability in IBM Langflow OSS. This exploit chains two vulnerabilities: CVE-2026-9103 : Auto-login bypass that grants superuser JWT token...

TerraMaster-TOS-CVE-2020-15568

TerraMaster TOS CVE-2020-15568 Repository for CVE-2020-15568 Metasploit module Vulnerable Application Description A dynamic class method invocation vulnerability exists in file include/exportUser.php which leads to executing remote commands on TerraMaster devices with root privileges. The...

CVE-2025-71389_exploit

CVE-2025-71389 — Cal.com Unauthenticated RCE react2shell Unauthenticated remote code execution in Cal.com = 5.9.8 via the React Server Components "Flight" deserialization flaw — "react2shell " CVE-2025-55182 in React, CVE-2025-66478 in Next.js. Cal.com bundles a vulnerable Next.js 15.x. A single...

CVE-2025-8625

CVE-2025-8625 Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution 🛡️ Copypress Rest API 1.1 - 1.2 RCE Exploit 📝 Description The Copypress Rest API plugin for WordPress versions 1.1 to 1.2 is vulnerable to Remote Code...

React2Shell-CVE-2025-55182

🎯 React2Shell CVE-2025-55182: From React Server Components to Full RCE Difficulty: Intermediate → Advanced Category: Web Exploitation | Deserialization | RCE 🧩 Task 1: Introduction — Why React2Shell Is a Big Deal CVE-2025-55182, nicknamed React2Shell , is one of those vulnerabilities that instant...

CVE-2026-39938

Vulnerability Report: Cacti Unauthenticated RCE on Graph Image Researcher: K | Product: Cacti ≤ 1.2.30 | CVE: CVE-2026-39938 01 Vulnerability Summary Field| Value ---|--- Product| Cacti — The Complete RRDtool-based Graphing Solution Affected Versions| ≤ 1.2.30 Vulnerability Class| CWE-22: Path...

glinet-beryl-ax-triple-rce-cve-2026-11450-11451-11452-unauthenticated-root-on-travel-router

GL.iNet Beryl AX Triple RCE PoC PoC for three unauthenticated command injection vulnerabilities CVE-2026-11450, CVE-2026-11451, CVE-2026-11452 in the GL.iNet GL-MT3000 Beryl AX travel router firmware = 4.4.5. Full writeup:...

CVE-2025-34085-Multi-target

CVE-2025-34085 Multi-Target RCE Scanner Mass-exploitation scanner for CVE-2025-34085 — an unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin. This tool uploads a PHP payload disguised as an image, renames it via a vulnerable file engine, and triggers shel...

CVE-2022-46169

CVE-2022-46169 POC This is a Proof of Concept POC script for the CVE-2022-46169 vulnerability that affects Cacti version 1.2.22. Description The CVE-2022-46169 vulnerability allows an unauthenticated command injection in Cacti versions through 1.2.22 in order to achieve unauthenticated remote cod...

CVE-2025-34085

Cyberlone Indonesia 🛠️ WordPress Simple File List RCE Scanner + Auto-Clean Automated tool to detect and exploit unauthenticated Remote Code Execution RCE on the WordPress Simple File List plugin, specifically those vulnerable to CVE-2025-34085. Equipped with an automatic target cleaning system and...

CVE-2022-24637

CVE-2022-24637 Open Web Analytics OWA - Unauthenticated Remote Code Execution https://vulners.com/cve/CVE-2022-24637 Example python3 exploit.py -u admin -p hacker http://target.org 10.10.11.12 4444...