rce

A webshell plugin and interactive shell for pentesting a Moodle instance.

Full and complete RCE exploit for Magento Polyshell

.-.WEBSHELL.-.

AtMail Email Server Appliance 6.4 - Exploit toolchain (XSS > CSRF > RCE)

This repository is a Dockerized php application containing a LFI (Local File Inclusion) vulnerability which can lead to RCE (Remote Code Execution).

Exploit for Joomla JCK Editor 6.4.4 (CVE-2018-17254)

Easy OWASP Inspired CTF | Web 2 Root

Log4j RCE - (CVE-2021-44228)

Patch for CVE-2025-54236(a.k.a Session Reaper) which allows customer account takeover and RCE under certain conditions. This patch is actually a Magento 2 extension and universal compatible for Magento 2.3 & 2.4. If you cannot upgrade Magento or cannot apply the official hotfix, try this one.

A vulnerable lab for understanding difference between LFI and File Retrieval

CVE-2026-63223 PoC — CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload bypass using image magic bytes. Fixed in v4.7.4.

The command injection sandbox is a tool for testing command injection vulnerabilities in web apps, in a safe environment.

Remote Code Execution Router/Load Balancer

Remote Code Execution Client

Remote Code Execution Server

CVE-2026-56705 - Adminer < 5.4.3 unauthenticated RCE via MSSQL PDO DSN injection (ODBC TraceFile arbitrary file write). PoC, Docker lab and negative test included.

Simple Command Shell

WARNING: This is a vulnerable application to test the exploit for the Cacti command injection (CVE-2022-46169). Run it at your own risk!

SSRF & RCE report log with discord webhook.

A simple PHP-based webshell that mimics a terminal interface, allowing execution of server-side commands for testing purposes.