goahead-webserver-pre-5.1.5-RCE-PoC-CVE-2021-42342-

Goahead webserver pre v5.1.5 RCE PoC CVE-2021-42342 A recent bug in Goahead Webserver was discovered by William Bowling which leads to RCE on the exploited server. The issue exists prior to version 5.1.5 which, according to Shodan covers around 2.8mio servers on the internet. A CVS is available n...

blackbird

Blackbird Blackbird is a powerful OSINT tool that combines fast username and email searches across more than 600 platforms with free AI-powered profiling. By leveraging community-driven projects like WhatsMyName, it ensures low false positive rates and high-quality results. Features include smart...

opencve

What is OpenCVE? OpenCVE is a Vulnerability Intelligence Platform that helps you monitor and manage CVEs efficiently. It aggregates vulnerabilities from multiple sources MITRE, NVD, RedHat, Vulnrichment... and lets you filter, track, and organize them by vendor, product, severity, and more. You c...

wordpress-shell

wordpress-shell Cheap & Nasty Wordpress Command Execution Shell. Execute Commands as the webserver you are serving wordpress with! Uploaded shell will probably be at /wp-content/plugins/shell/shell.php Install To install the shell, we are assuming you have administrative access to the Wordpress...

bmcweb

OpenBMC webserver This component attempts to be a "do everything" embedded webserver for OpenBMC. Features The webserver implements a few distinct interfaces: DBus event websocket. Allows registering for changes to specific dbus paths, properties, and will send an event from the websocket if thos...

venom

VENOM 1.0.17 - metasploit Shellcode generator/compiller Version release : v1.0.17 Author : pedro ubuntu r00t-3xp10it Codename: Aconite Aconitum napellus Distros Supported : Linux Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam develop @2019 LEGAL DISCLAMER The author does not...

CVE-2022-39066

CVE-2022-39066 Firmware details: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisites requests pip install requests SQL injection The vulnerability is a SQL injection present in the handler PHONEBLOCKADD in the webserver goahead binary. Possible exploits:...

CVE-2022-39073

CVE-2022-39073 Firmware details: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisites requests pip install requests Command Injection The vulnerability is a shared command injection between the ztenetlinkdetect binary and the WATCHDOGSWITCH handler in the...

EUVD-2026-105978

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-101570

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

cve-2021-31630

cve-2021-31630 OpenPLC WebServer v3 - Authenticated RCE This PoC script is based on the exploit provided by Fellipe Oliveira. Features : Directly uploads C code to /hardware instead of st file upload Restores default program before uploading reverse shell Improved C based reverse shell which is n...

CVE-2026-101570

A vulnerability exists in the helidon-webserver-http2 component of the Helidon product within Oracle Fusion Middleware . Affected versions range from 4.0.0 to 4.5.5 . An unauthenticated attacker with network access via HTTP/2 can exploit this difficulty-to-exploit vulnerability to cause a partial...

Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

CVE-2021-35956

CVE-2021-35956. Proof of Concept Exploit for CVE-2021-35956, AKCP sensorProbe - 'Multiple' Cross Site Scripting XSS. Exploit Title: AKCP sensorProbe - 'Multiple' Cross Site Scripting XSS. Date: 07-01-2021. Exploit Author: Tyler Butler. Vendor Homepage: https://www.akcp.com/. Software Link:...

CVE-2021-31630

OpenPLC WebServer v3 - Authenticated RCE CVE-2021-31630 This exploit is based on the exploit from Exploit-DB made by Fellipe Oliveira. First, authenticate Upload a malicious C file Compile it Start the PLC initiate reverse shell Stop the PLC no need to run it, the reverse shell is already initiat...

Odysseus

Odysseus A demo of the Log4Shell CVE-2021-44228 vulnerability. Build Instructions The vulnerable webserver and malicious LDAP server were both built and tested on JDK 1.8.0181. Good Guys Web Server 1. Inside goodguys, run gradlew bootJar 2. Run vulnerable webserver using java -jar...

CVE-2021-31630-OpenPLC-3-Authenticated-RCE

CVE-2021-31630 OpenPLC 3 WebServer Authenticated Remote Code Execution. Description The presence of Command Injection in Open PLC Webserver v3 enables remote attackers to run arbitrary code by exploiting the "Hardware Layer Code Box" component found on the "/hardware" page of the application. Onl...

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

Caddy 2.4.6 - Open Redirect

Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-28923 info: name: Caddy 2.4.6 - Open Redirect author: Sascha...

PT-2026-119250

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...