CVE-2025-8088

None

Github link:
https://github.com/pentestfunctions/CVE-2025-8088-Multi-Document

CVE-2025-54352

None

Github link:
https://github.com/ScarryParrot/-CVE-2025-54352

CVE-2019-15107

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Github link:
https://github.com/ArtemCyberLab/Project-Exploitation-of-Webmin-Authentication-Vulnerability

CVE-2018-7422

A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.

Github link:
https://github.com/ndr-repo/CVE-2018-7422

CVE-2025-6934

None

Github link:
https://github.com/0xgh057r3c0n/CVE-2025-6934

CVE-2025-27591

A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.

Github link:
https://github.com/umutcamliyurt/CVE-2025-27591

CVE-2025-49667

None

Github link:
https://github.com/Yuri08loveElaina/CVE-2025-49667

CVE-2025-8088

None

Github link:
https://github.com/pexlexity/WinRAR-CVE-2025-8088-Path-Traversal-PoC

CVE-2024-28397

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

Github link:
https://github.com/waleed-hassan569/CVE-2024-28397-command-execution-poc

CVE-2019-12185

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.

Github link:
https://github.com/Drew-Alleman/CVE-2019-12185

CVE-2025-8875

None

Github link:
https://github.com/rxerium/CVE-2025-8875-CVE-2025-8876

CVE-2015-10141

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.

Github link:
https://github.com/n0m4d22/PoC-CVE-2015-10141-Xdebug

CVE-2025-54253

None

Github link:
https://github.com/jm7knz/CVE-2025-54253-Exploit-Demo

CVE-2025-9090

None

Github link:
https://github.com/byteReaper77/CVE-2025-9090

CVE-2025-32778

None

Github link:
https://github.com/00xCanelo/CVE-2025-32778

CVE-2024-28397

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

Github link:
https://github.com/0timeday/exploit-js2py

CVE-2025-49132

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.

Github link:
https://github.com/GRodolphe/CVE-2025-49132_poc

CVE-2025-4334

The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for unauthenticated attackers to register as an administrator.

Github link:
https://github.com/0xgh057r3c0n/CVE-2025-4334

CVE-2013-3900

The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification, which allows remote attackers to execute arbitrary code via a crafted PE file, aka "WinVerifyTrust Signature Validation Vulnerability."

Github link:
https://github.com/PREN0MEN/CVE-2013-3900-PowerShell-PoC

CVE-2025-7771

None

Github link:
https://github.com/Yuri08loveElaina/CVE-2025-7771