CVE-2024-4577

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Github link:
https://github.com/cheerfulempl/CVE-2024-4577-PHP-RCE

CVE-2025-31200

None

Github link:
https://github.com/zhuowei/apple-positional-audio-codec-invalid-header

CVE-2025-30208

None

Github link:
https://github.com/imbas007/CVE-2025-30208-template

CVE-2025-30065

None

Github link:
https://github.com/ThreatRadarAI/TRA-001-Critical-RCE-Vulnerability-in-Apache-Parquet-CVE-2025-30065-Simulation-

CVE-2024-40445

None

Github link:
https://github.com/TaiYou-TW/CVE-2024-40445_CVE-2024-40446

CVE-2025-31161

None

Github link:
https://github.com/TX-One/CVE-2025-31161

CVE-2021-34371

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.

Github link:
https://github.com/tavgar/CVE-2021-34371

CVE-2024-28987

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Github link:
https://github.com/alecclyde/CVE-2024-28987

CVE-2025-24016

None

Github link:
https://github.com/cybersecplayground/CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC

CVE-2025-43919

None

Github link:
https://github.com/cybersecplayground/CVE-2025-43919-POC

CVE-2023-44487

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Github link:
https://github.com/zanks08/cve-2023-44487-demo

CVE-2025-29529

None

Github link:
https://github.com/Yoshik0xF6/CVE-2025-29529

CVE-2025-32140

None

Github link:
https://github.com/Nxploited/CVE-2025-32140

CVE-2025-24054

None

Github link:
https://github.com/helidem/CVE-2025-24054-PoC

CVE-2024-49138

None

Github link:
https://github.com/CyprianAtsyor/letsdefend-cve-2024-49138-investigation

CVE-2024-27876

None

Github link:
https://github.com/0xilis/CVE-2024-27876

CVE-2023-25157

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.

Github link:
https://github.com/charis3306/CVE-2023-25157

CVE-2024-12905

None

Github link:
https://github.com/theMcSam/CVE-2024-12905-PoC

CVE-2024-42471

None

Github link:
https://github.com/theMcSam/CVE-2024-42471-PoC

CVE-2021-43857

Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.

Github link:
https://github.com/G4sp4rCS/CVE-2021-43857-POC