7325 matches found
PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)
This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry complex-direct request invokes privileged ConfigEditor components through the public Home page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose initialization SQL...
SPIP X-Spip-Filtre Unauthenticated RCE
This module exploits a PHP function-call injection in SPIP's template engine. The analyseresultatskel function extracts patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter value, which places a header call o...
Tenable Security Center Report Charting RCE
Tenable Security Center prior to 6.9.0 allows an authenticated, non-administrative user to achieve code execution as the web service account tns through report generation. A report definition's inline style is discarded at render components rehydrate styles from the Style tables by styleID, so th...
Tenable Security Center SCAP Audit File Command Injection
Tenable Security Center prior to 6.9.0 allows an authenticated user to achieve command execution as the web service account tns via the SCAP audit file upload flow. Filesystem::saveTmp builds staged upload filenames from the raw client-supplied context form parameter tempnam prefix, which is not...
Forgejo Arbitrary File Read via Org-mode Include
Forgejo versions 7.0 through 15.0.5 and 16.0.0 through 16.0.1 are vulnerable to an arbitrary file read via the markup rendering API endpoint. The go-org library's default ReadFile callback ioutil.ReadFile is not overridden, allowing the +INCLUDE directive to read arbitrary files accessible to the...
Ruby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution
This module exploits CVE-2026-66066 in Ruby on Rails Active Storage when the application uses the Vips variant processor and accepts untrusted image uploads. A crafted MATLAB v7.3/HDF5 image uses external storage to read text files accessible to the Rails worker through a PNG representation...
JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution
This module exploits an unsafe XStream deserialization vulnerability in the JetBrains TeamCity agent polling protocol. An unauthenticated attacker can register a build agent, then submit a crafted error response that causes TeamCity to deserialize an attacker-controlled object graph. The object...
Check Point SmartConsole Authentication Bypass Run Script RCE
This module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an application...
Langflow AI auto_login RCE
Langflow versions 1.10.0 and below are susceptible to unauthenticated remote code execution. By chaining /api/v1/autologin with /api/v1/validate/code, a remote unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. Module Options msf use...
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated SQL injection reachable through the REST API batch endpoint /batch/v1. The batch controller builds parallel $matches the matched handler per sub-request and $validation the validation result per sub-request arrays,...
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
This module chains two WordPress core vulnerabilities, together known as WP2Shell, to gain unauthenticated remote code execution against default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. The vulnerabilities are fixed in WordPress 6.9.5 and 7.0.2. CVE-2026-60137 is an SQL injection in...
Microsoft Windows HTTP to SMB Relay
This module supports running an HTTP server which validates credentials, and then attempts to execute a relay attack against an SMB server on the configured RHOSTS hosts. If the relay succeeds, an SMB session to the target will be created. This can be used by any modules that support SMB sessions...
Ray Dashboard Logs API Path Traversal
Ray Dashboard versions 2.56.0 and earlier are vulnerable to path traversal through the /api/v0/logs endpoint, allowing unauthenticated attackers to enumerate and read filesystem paths via attacker-controlled glob paths. Module Options msf use auxiliary/gather/ray/dashboardlogsapipathtraversal msf...
SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution
This module exploits a Server-Side Request Forgery SSRF vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service to access the internal Erlang distribution service. After authenticating using the known Erlang distribution cookie, the module invokes os:cmd/1 through Erlang RPC to execute...
Linux dup2 Command Shell, Bind TCP Stager
dup2 socket in s1, then execve. Listen for a connection Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 264 include...
Linux dup2 Command Shell, Bind TCP Stager
dup2 socket in s1, then execve. Listen for a connection Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 256 include...
Linux Meterpreter, Reverse TCP Inline
Run the Meterpreter / Mettle server payload stageless Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Single include Msf::Sessions::MeterpreterOptions::Linu...
Linux dup2 Command Shell, Reverse TCP Stager
dup2 socket in s1, then execve. Connect back to the attacker Module Options frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 224 include...
Linux dup2 Command Shell, Reverse TCP Stager
dup2 socket in s1, then execve. Connect back to the attacker Module Options...
FTP Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support
Fetch and execute an x64 payload from an FTP server. Listen for an IPv6 connection with UUID Support Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Windows Command Shell, Bind IPv6 TCP Stager with UUID Support (Windows x86)
Fetch and execute an x86 payload from an FTP server. Spawn a piped command shell staged. Listen for an IPv6 connection with UUID Support Windows x86 Module Options...
FTP Fetch, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Spawn a piped command shell staged. Connect back to the attacker Module Options...
FTP Fetch, Windows Upload/Execute, Bind IPv6 TCP Stager with UUID Support (Windows x86)
Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Listen for an IPv6 connection with UUID Support Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...
FTP Fetch, Windows shellcode stage, Reverse All-Port TCP Stager
Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...
FTP Fetch, Reverse TCP Stager (IPv6)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker over IPv6 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Connect back to the attacker Module Options...
FTP Fetch, Bind IPv6 TCP Stager (Windows x86)
Fetch and execute an x86 payload from an FTP server. Listen for an IPv6 connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Hidden Bind Ipknock TCP Stager
Fetch and execute an x86 payload from an FTP server. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket...
FTP Fetch, Windows x86 Reverse Named Pipe (SMB) Stager
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker via a named pipe pivot Module Options...
FTP Fetch, Windows x64 IPv6 Bind TCP Stager
Fetch and execute an x64 payload from an FTP server. Listen for an IPv6 connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Reverse TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker No NX Module Options...
FTP Fetch, Reverse Ordinal TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...
FTP Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager with UUID Support
Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Listen for an IPv6 connection with UUID Support Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source:...
FTP Fetch, Windows Meterpreter Shell, Bind Named Pipe Inline
Fetch and execute an x86 payload from an FTP server. Connect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options...
FTP Fetch, Windows x64 IPv6 Bind TCP Stager
Fetch and execute an x64 payload from an FTP server. Listen for an IPv6 connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Windows shellcode stage, Reverse TCP Stager
Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Connect back to the attacker Module Options...
FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...
FTP Fetch, Find Tag Ordinal Stager
Fetch and execute an x86 payload from an FTP server. Use an established connection Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP inclu...
FTP Fetch, Windows Upload/Execute, Find Tag Ordinal Stager
Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Use an established connection Module Options...
FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...
FTP Fetch, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Connect back to the attacker No NX Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...
FTP Fetch, Bind TCP Stager with UUID Support (Windows x86)
Fetch and execute an x86 payload from an FTP server. Listen for a connection with UUID Support Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x64 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...
FTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline (IPv6)
Fetch and execute an x86 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options...
FTP Fetch, Windows shellcode stage, Bind TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Listen for a connection No NX Module Options...
FTP Fetch, Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule includ...
FTP Fetch, Bind TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Listen for a connection No NX Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP inclu...
FTP Fetch, Windows x86 Bind Named Pipe Stager
Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Bind IPv6 TCP Stager with UUID Support (Windows x86)
Fetch and execute an x86 payload from an FTP server. Listen for an IPv6 connection with UUID Support Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...