$ grep -r "rce"
An XWiki instance on a hidden vhost is vulnerable to CVE-2025-24893, an unauthenticated Groovy injection in the SolrSearch endpoint, which is used to stage and run a reverse shell as the xwiki user. XWiki's hibernate.cfg.xml leaks a database password reused for SSH as oliver. oliver belongs to the netdata group, and the SUID ndsudo helper (CVE-2024-32019) resolves its target binaries through the untrusted PATH, so a PATH hijack runs an attacker-controlled binary as root.
A file-upload form validates image extension and MIME magic bytes but permits a PHP double extension, which an Apache handler misconfiguration executes, yielding a shell as www-data. A cron job running as guly passes uploaded filenames unsanitised to exec(), so a filename containing shell metacharacters achieves command injection and a shell as guly. guly may run a network-configuration script as root that reads interface values into a config file, and a known ifcfg script-injection flaw turns those values into root command execution.
A blog's password-reset form is vulnerable to SQL injection, which dumps and cracks the admin bcrypt hash. The admin panel runs a vulnerable Laravel-admin (CVE-2023-24249) whose avatar upload is bypassed by tampering the multipart filename in Burp to land a PHP webshell, giving a shell as dash. A reused password in dash's .monitrc grants SSH as xander, who can run a custom root binary that invokes 7-Zip with an unquoted wildcard; a crafted @-listfile symlink leaks root's private SSH key.
A Dolibarr CRM on a hidden vhost runs on default admin credentials and is vulnerable to authenticated PHP code injection (CVE-2023-30253), giving a shell as www-data. Its config file leaks database credentials reused for SSH as larissa. A SUID enlightenment binary is vulnerable to CVE-2022-37706, which is abused for a root shell.
Default credentials open a vulnerable Tiny File Manager (CVE-2021-45010), whose writable uploads directory gives a PHP reverse shell as www-data. The nginx config reveals a soc-player vhost vulnerable to a WebSocket-based blind SQL injection, which dumps SSH credentials for player. A doas rule allowing dstat is abused with a malicious Python plugin to spawn a root shell.
An exposed .git directory leaks the Backdrop CMS database password, which logs us into the admin panel. An authenticated module-upload flaw gives RCE as www-data, the leaked password is reused for SSH as johncusack, and a sudo-allowed bee command evaluates PHP as root.
An outdated Apache ActiveMQ broker is vulnerable to unauthenticated RCE (CVE-2023-46604), giving a shell as activemq. A sudo rule allowing nginx to be run as root is abused — a malicious config turns nginx into a WebDAV server that writes an SSH key into root's authorized_keys for a root login.