CVE-2025-4427

The repository contains a functional exploit PoC for CVE-2026-22812, demonstrating remote command execution (RCE) in OpenCode. The script sends a crafted JSON payload to the target's session endpoint, then executes the 'id' command via the shell endpoint, verifying RCE by checking for 'uid=' and 'gid=' in the response.

This script detects vulnerability to CVE-2025-4427 and CVE-2025-4428 in Ivanti EPMM by executing an `id` command via a crafted URL. It checks for a specific response pattern to determine vulnerability.

This repository provides a detailed writeup and Nuclei template for detecting CVE-2025-4427 (authentication bypass) and CVE-2025-4428 (post-auth RCE via EL injection in Ivanti EPMM). The chained vulnerabilities allow unauthenticated remote code execution.

This Python script exploits CVE-2025-4427 (Expression Language Injection) and CVE-2025-4428 (Authentication Bypass) in Ivanti Endpoint Manager Mobile. It includes detection and exploitation capabilities for unauthenticated RCE via crafted requests to the featureusage API endpoint.