CVE-2021-34371

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.

Github link:
https://github.com/tavgar/CVE-2021-34371

CVE-2024-28987

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Github link:
https://github.com/alecclyde/CVE-2024-28987

CVE-2025-24016

None

Github link:
https://github.com/cybersecplayground/CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC

CVE-2025-43919

None

Github link:
https://github.com/cybersecplayground/CVE-2025-43919-POC

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Github link:
https://github.com/zanks08/cve-2023-44487-demo

CVE-2025-29529

None

Github link:
https://github.com/Yoshik0xF6/CVE-2025-29529

CVE-2025-32140

None

Github link:
https://github.com/Nxploited/CVE-2025-32140

CVE-2025-24054

None

Github link:
https://github.com/helidem/CVE-2025-24054-PoC

CVE-2024-49138

None

Github link:
https://github.com/CyprianAtsyor/letsdefend-cve-2024-49138-investigation

CVE-2024-27876

None

Github link:
https://github.com/0xilis/CVE-2024-27876

CVE-2023-25157

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.

Github link:
https://github.com/charis3306/CVE-2023-25157

CVE-2024-12905

None

Github link:
https://github.com/theMcSam/CVE-2024-12905-PoC

CVE-2024-42471

None

Github link:
https://github.com/theMcSam/CVE-2024-42471-PoC

CVE-2021-43857

Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.

Github link:
https://github.com/G4sp4rCS/CVE-2021-43857-POC

CVE-2023-30861

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets `session.permanent = True`
3. The application does not access or modify the session at any point during a request.
4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default).
5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is ac

Github link:
https://github.com/fromitive/cve-2023-30861-poc

CVE-2019-5420

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.

Github link:
https://github.com/sealldeveloper/CVE-2019-5420-PoC

CVE-2024-32830

None

Github link:
https://github.com/ptrstr/CVE-2024-32830-poc

CVE-2023-41425

Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.

Github link:
https://github.com/becrevex/CVE-2023-41425

CVE-2016-2098

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Github link:
https://github.com/sealldeveloper/CVE-2016-2098-PoC

CVE-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

Github link:
https://github.com/sealldeveloper/CVE-2016-10033-PoC

CVE-2018-0114

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.

Github link:
https://github.com/sealldeveloper/CVE-2018-0114-PoC