CVE-2025-24813-vulhub

CVE-2025-24813-vulhub POC script for vulhub environment of CVE-2025-24813 Because many friends are confused about how to exploit this vulnerability, I wrote this script to help everyone with the exploitation in vulhub. Details: vulhub/tomcat/CVE-2025-24813 There is no directly exploitable chain i...

Log4Shell-Vulnerability-Replication

CVE-2021-44228 Log4Shell Vulnerability Complete Replication Record This record is based on the Apache Solr 8.11.0 target environment provided by Vulhub, fully replicating the Log4j2 JNDI injection vulnerability, and successfully verifying the vulnerability's existence through DNSLog and local LDA...

St2-057

St2-057 Online Target Machine Environment, Enjoy! 0x01 Set Up the Docker Environment https://github.com/vulhub/vulhub/tree/master/struts2/s2-048 docker-compose up -d 0x02 Set Up the st2-057 Vulnerability Environment docker exec -i -t 88fd8d560155 /bin/bash Start the service in the background and...

Ruby On Rails - Local File Inclusion

Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server. id: CVE-2018-3760 info: name: Ruby On Rails - Local File Inclusio...

CVE-2018-20062

CVE-2018-20062 thinkphp 5.0.23 Suitable for vulhub thinkphp vulnerability I'm a noob. I'll optimize it gradually later. Please don't criticize, experts...

Sub-folderFetcher

Sub-folder Fetcher 🐣 A script to download specific Vulhub repository folder kibana/CVE-2018-17246 from GitHub. 🚀 Requirements curl unzip 🛠️ Usage chmod +x subfetcher.sh ./subfetcher.sh...

POC_CVE-2023-21839

CVE-2023-21839 Translated the GO version of @4ra1n into Python based on specific needs, thanks again! Disclaimer This program should only be used for authorized security testing and research purposes. Users should comply with the Cybersecurity Law and use it reasonably. Any illegal attacks or oth...

CVE-2024-9264

CVE-2024-9264 References https://github.com/vulhub/vulhub/tree/master/grafana/CVE-2024-9264 1. Vulnerability Summary Item| Content ---|--- CVE| CVE-2024-9264 Target| Grafana SQL Expressions Impact| Local File Inclusion LFI, Remote Code Execution RCE Severity| Critical CVSS 9.9 Attack Condition|...

Cve-2023-28432-

Cve-2023-28432 Implemented basic batch detection through the vulhub reproduction process. It's quite crappy but barely usable. vulhub link https://github.com/vulhub/vulhub/tree/master/minio/CVE-2023-28432 Instructions: Create a new tagerts.txt file and put the minIO API port links into it. Just r...

ElasticSearch v1.1.1/1.2 RCE

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. id: CVE-2018-18925 info: name: Go...

GitList < 0.6.0 Remote Code Execution

klaussilveira GitList version = 0.6 contains a passing incorrectly sanitized input via the searchTree function that can result in remote code execution. id: CVE-2018-1000533 info: name: GitList 0.6.0 Remote Code Execution author: pikpikcu severity: critical description: klaussilveira GitList...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

vulhub-apache

This repository does not have a README...

Rocket.Chat <=3.13 - NoSQL Injection

Rocket.Chat 3.11, 3.12 and 3.13 contains a NoSQL injection vulnerability which allows unauthenticated access to an API endpoint. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected...

Apache httpd <=2.4.29 - Arbitrary File Upload

Apache httpd 2.4.0 to 2.4.29 is susceptible to arbitrary file upload vulnerabilities via the expression specified in , which could match '$' to a newline character in a malicious filename rather than matching only the end of the filename. This could be exploited in environments where uploads of...

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

Apache Solr DataImportHandler <8.2.0 - Remote Code Execution

Apache Solr is vulnerable to remote code execution vulnerabilities via the DataImportHandler, an optional but popular module to pull in data from databases and other sources. The module has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug...

Jenkins - Remote Command Injection

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this wa...