Every new exploit,
on the radar.

Ruby On Rails unrestricted render() exploit

Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data.

Proof of concept showing how CVE-2016-2098 leads to remote code execution

This exploit is remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data

CVE-2016-2098 POC

A PoC of CVE-2016-2098 (rails4.2.5.1 / view render)

Proof of concept CVE-2016-2098

CVE-2016-2098 simple POC written in bash

Docker environment and exploit the CVE-2023-30212 vulnerabilityVE-2023-30212 is a security vulnerability that affects versions of OURPHP prior to or equal to 7…

This repository provides a Docker container for simulating the CVE-2023-30212 vulnerability, allowing you to practice and understand its impact. It includes a …

This contains the necessary files and Docker to replicate A vulnerability in OURPHP that has a XSS Vulnerability (CVE-2023-30212)

GitHub repository with Dockerfile and files to create a vulnerable environment for CVE-2023-30212, enabling exploration of the exploitability of this security …

Docker environment and exploit the CVE-2023-30212 is a security vulnerability that affects versions of OURPHP prior to or equal to 7.2.0 .This vulnerability al…

Docker environment and exploit the CVE-2023-30212 vulnerabilityVE-2023-30212 is a security vulnerability that affects versions of OURPHP prior to or equal to 7…

CVE-2024-38816 Proof of Concept

CVE-2024-38816

Fixed cve-2024-38816 based on version 5.3.39

Fork spring-webmvc 5.3.39 to fix CVE-2024-38816, CVE-2024-38819

Learn more things, not suck all things

CVE for 2023

MLflow LFI/RFI Vulnerability -CVE-2023-1177 - Reproduced

MLFlow Path Traversal

PoC of CVE-2023-1177 vulnerability in MLflow (Reproduce)

CVE-2022-22978 Spring-Security bypass Demo

PoC of CVE-2022-22978 vulnerability in Spring Security framework

CVE-2022-22978 POC Project

CVE-2022-22978漏洞实例代码

Exploit for Mass Remote Code Execution on GPON home routers (CVE-2018-10562) obtained from Shodan.

Exploit for Remote Code Execution on GPON home routers (CVE-2018-10562) written in Python.

Exploit for CVE-2018-10562

Exploit loader for Remote Code Execution w/ Payload on GPON Home Gateway devices (CVE-2018-10562) written in Python.

Python exploit for Remote Code Executuion on GPON home routers (CVE-2018-10562). Initially disclosed by VPNMentor (https://www.vpnmentor.com/blog/critical-vuln…

backdoor.mirai.helloworld cve2018-20561, cve-2018-10562 해킹

Exploitation code for CVE-2021-40539

CVE-2021-40539 POC

ADSelfService Plus RCE漏洞 检测工具 (二开)

CVE-2021-40539：ADSelfService Plus RCE漏洞

CVE-2021-40539：ADSelfService Plus RCE漏洞

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.

CVE-2024-29269

Telesquare TLR-2005KSH_RCE (CVE-2024-29269) Batch scan/exploit

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.

CVE-2019-18818/19606 Strapi RCE

Exploit script showcasing a mixture of CVE-2019-18818 and CVE-2019-19609 for unauthenticated remote code execution in Strapi CMS.

This repository contains a Python script to exploit two vulnerabilities: CVE-2019-18818 and CVE-2019-19609.

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted reso…

Ivanti Pulse Secure CVE-2023-46805 Scanner - Based on Assetnote's Research

Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887.

Scanner for CVE-2023-46805 - Ivanti Connect Secure

Simple scanner for scanning a list of ip-addresses for vulnerable Ivanti Pulse Secure devices

The script in this repository only checks whether the vulnerabilities specified in the Ivanti Connect Secure product exist.

A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, an…

CVE-2023-46805 Ivanti POC RCE - Ultra fast scanner.

Confluence Server Webwork OGNL injection

CVE-2021-26084 Remote Code Execution on Confluence Servers

Atlassian Confluence CVE-2021-26084 one-liner mass checker

CVE-2021-26084 - Confluence Pre-Auth RCE | OGNL injection

POC of CVE-2021-26084, which is Atlassian Confluence Server OGNL(Object-Graph Navigation Language) Pre-Auth RCE Injection Vulneralibity.

Remote Code Execution on Confluence Servers : CVE-2021-26084

weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、C…

CVE-2014-4210+Redis未授权访问

Weblogic SearchPublicRegistries SSRF(CVE-2014-4210) Exploit Script based on Python3

CVE-2014-4210 SSRF PORTSCANNER PoC

CVE-2022-24086 about Magento RCE

Verifed Proof of Concept on CVE-2022-24086

Proof of concept of CVE-2022-24086

PoC of CVE-2022-24086

CVE-2022-24086 RCE

CVE-2022-24086 POC example

PAN-OS auth bypass + RCE

Palo Alto Networks PAN-OS(CVE-2024-9474) POC

Palo Alto RCE Vuln

PoC for PAN-OS Exploit

Exploit for the vulnerability CVE-2024-43044 in Jenkins

The script checks Jenkins endpoints for CVE-2024-43044 by retrieving the Jenkins version from the innstance and comparing it against known vulnerable version r…

CVE-2024-43044的利用方式

This repository provides a workaround preventing exploitation of SECURITY-3430 / CVE-2024-43044

This is the exploit of CVE-2019-17240.

Bludit <= 3.9.2 - Authentication Bruteforce Mitigation Bypass Exploit/PoC

Bludit 3.9.2 - Auth Bruteforce Bypass CVE:2019-17240 Refurbish In bash

Bludit 3.9.2 - bruteforce bypass - CVE-2019-17240

Better version of rastating.github.io/bludit-brute-force-mitigation-bypass/

Bypass bludit mitigation login form and upload malicious to call a rev shell

Bludit 3.9.2 - Auth Brute Force Mitigation Bypass. CVE-2019-17240

WordPress Elementor 3.6.0 3.6.1 3.6.2 RCE POC

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/c…

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution

CVE-2017-12617 is a critical vulnerability leading to Remote Code Execution (RCE) in Apache Tomcat.

Proof of Concept - RCE Exploitation : Web Shell on Apache Tomcat - Ensimag January 2018

Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution for Python3

An implementation of CVE-2017-12617

Code put together from a few peoples ideas credit given don't use maliciously please

漏洞POC、EXP合集，持续更新。Apache Druid-任意文件读取（CVE-2021-36749）、ConfluenceRCE（CVE-2021-26084）、ZeroShell防火墙RCE（CVE-2019-12725）、ApacheSolr任意文件读取、蓝凌OA任意文件读取、phpStudyRCE、Show…

ZeroShell 3.9.0 Remote Command Injection

CVE-2019-12725 ZeroShell 远程命令执行漏洞

ZeroShell命令执行漏洞批量扫描poc+exp

Exploits for Android Binder bug CVE-2020-0041

Adapted CVE-2020-0041 root exploit for Pixel 3

Local privilege escalation exploit for Android Binder bug CVE-2020-0041 (Pixel 3a)

This small script helps to avoid using MetaSploit (msfconsole) during the Enterprise pentests and OSCP-like exams. Grep included function will help you to get …

Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure (Python3)

Webmin < 1.290 / Usermin < 1.220 - Arbitrary file disclosure

It is a simple tool to exploit local file include . vulnerabilities

Python script to exploit webmin vulnerability cve-2006-3392

Webmin Local File Include (unauthenticated)

cve-2022-23131 zabbix-saml-bypass-exp

cve-2022-23131 exp

cve-2022-23131

Zabbix - SAML SSO Authentication Bypass

CVE-2022-23131漏洞利用工具开箱即用。

Zabbix SSO Bypass

CVE-2022-23131漏洞批量检测与利用脚本

CVE-2022-23131 Zabbix Server SAML authentication exploit

CVE-2024-21683 Confluence Post Auth RCE

This vulnerability could allow an attacker to take complete control of a vulnerable Confluence server. This could allow the attacker to steal data, modify data…

This vulnerability allows an unauthenticated attacker to remotely execute arbitrary code on a vulnerable Confluence server. The vulnerability exists due to an …

CVE-2024-21683 Confluence Post Auth RCE

Progress Telerik Report Server pre-authenticated RCE chain (CVE-2024-4358/CVE-2024-1800)

Authentication Bypass Vulnerability — CVE-2024–4358 — Telerik Report Server 2024

An Vulnerability detection and Exploitation tool for CVE-2024-4358

Telerik Report Server deserialization and authentication bypass exploit chain for CVE-2024-4358/CVE-2024-1800

CVE-2022-41040 - Server Side Request Forgery (SSRF) in Microsoft Exchange Server

the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker ca…

CVE-2022-41040 nuclei template

mitigation script for MS Exchange server vuln

Code set relating to CVE-2022-41040

Script to check for IOC's created by ProxyNotShell (CVE-2022-41040 & CVE-2022-41082)