CVE-2025-7766

This exploit demonstrates an XXE (XML External Entity) injection vulnerability in Lantronix Provisioning Manager ≤ 7.10.3. It allows an attacker to read arbitrary files (e.g., /etc/passwd) or trigger outbound HTTP requests to an attacker-controlled server.

This repository contains a functional exploit for CVE-2025-7766, demonstrating an XXE vulnerability that allows reading files (e.g., /etc/passwd) and triggering out-of-band HTTP callbacks. The exploit is written in C and uses libcurl to send crafted XML payloads to a target endpoint.