CVE-2024-28397

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

Github link:
https://github.com/waleed-hassan569/CVE-2024-28397-command-execution-poc

CVE-2019-12185

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

Github link:
https://github.com/Drew-Alleman/CVE-2019-12185

CVE-2025-8875

None

Github link:
https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876

CVE-2015-10141

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.

Github link:
https://github.com/n0m4d22/PoC-CVE-2015-10141-Xdebug

CVE-2025-54253

None

Github link:
https://github.com/jm7knz/CVE-2025-54253-Exploit-Demo

CVE-2025-9090

None

Github link:
https://github.com/byteReaper77/CVE-2025-9090

CVE-2025-32778

None

Github link:
https://github.com/00xCanelo/CVE-2025-32778

CVE-2024-28397

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

Github link:
https://github.com/0timeday/exploit-js2py

CVE-2025-49132

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.

Github link:
https://github.com/GRodolphe/CVE-2025-49132_poc

CVE-2025-4334

The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.

Github link:
https://github.com/0xgh057r3c0n/CVE-2025-4334

CVE-2013-3900

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability."

Github link:
https://github.com/PREN0MEN/CVE-2013-3900-PowerShell-PoC

CVE-2025-7771

None

Github link:
https://github.com/Yuri08loveElaina/CVE-2025-7771

CVE-2015-6967

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.

Github link:
https://github.com/innocentx0/CVE-2015-6967-EXPLOIT

CVE-2020-36708

None

Github link:
https://github.com/b1g-b33f/CVE-2020-36708

CVE-2025-8671

None

Github link:
https://github.com/moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS

CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Github link:
https://github.com/SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHP

CVE: CVE-2025-49113
Author: SteamPunk424
NIST: https://nvd.nist.gov/vuln/detail/CVE-2025-49113

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

GitHub: https://github.com/SteamPunk424/CVE-2025-49113-Roundcube-RCE-PHP

CVE: CVE-2020-36708
Author: b1g-b33f
NIST: https://nvd.nist.gov/vuln/detail/CVE-2020-36708

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

GitHub: https://github.com/b1g-b33f/CVE-2020-36708

CVE: CVE-2025-8671
Author: moften
NIST: https://nvd.nist.gov/vuln/detail/CVE-2025-8671

None

GitHub: https://github.com/moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS

CVE: CVE-2015-6967
Author: innocentx0
NIST: https://nvd.nist.gov/vuln/detail/CVE-2015-6967

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/my_image/image.php.

GitHub: https://github.com/innocentx0/CVE-2015-6967-EXPLOIT

CVE-2025-8723

None

Github link:
https://github.com/Nxploited/CVE-2025-8723