Every new exploit,
on the radar.

CVE-2025-30208-EXP

全网首发 CVE-2025-31125 CVE-2025-30208 CVE-2025-32395 Vite Scanner

A PoC of the exploit script for the Arbitrary File Read vulnerability of Vite /@fs/ Path Traversal in the transformMiddleware (CVE-2025-30208).

CVE-2025-30208-EXP 任意文件读取

CVE‑2025‑30208 is a medium-severity arbitrary file read vulnerability in the Vite development server (a popular frontend build tool)

针对CVE-2025-30208和CVE-2025-31125的漏洞利用

CVE-2025-30208 - Vite Arbitrary File Read PoC

Certighost POC

🛡️ Official AI Security Tool module for CVE-2026-54121 (Certighost - AD CS Domain Controller Impersonation & PKINIT Elevation).

CVE-2026-54121 - CertiGhost AD CS Multi-Exploit Framework | Rogue DC + LDAP spoofing, certificate abuse, PKINIT hash extraction, auto DCSync. Safe Checker + fu…

CVE-2026-54121 (Certighost) AD CS DC-impersonation PoC. Patched SAN handling + MAQ-safe account reuse.

A Metasploit auxiliary module that escalates from any low-privileged domain user to full domain compromise by abusing the AD CS enrollment "chase" fallback. T…

CVE-2026-54121

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

poc for CVE-2024-38063 (RCE in tcpip.sys)

Note: I am not responsible for any bad act. This is written by Chirag Artani to demonstrate the vulnerability.

CVE-2024-38063 is a critical security vulnerability in the Windows TCP/IP stack that allows for remote code execution (RCE)

mitigation script by disabling ipv6 of all interfaces

potential memory corruption vulnerabilities in IPv6 networks.

Windows TCP/IP IPv6(CVE-2024-38063)

Vulnerability CVE-2024-38063

CVE-2026-41651 — PackageKit TOCTOU LPE

CVE-2026-41651

Poc for Pack2TheRoot CVE-2026-41651

CTF-style Docker lab for CVE-2026-41651 (Pack2TheRoot): PackageKit permissive-polkit local privilege escalation

Exploit for CVE-2026-41651 - PackageKit TOCTOU Local Privilege Escalation (Pack2TheRoot)

CVE-2026-75604 Next.js Windows RCE poc

A Python-based exploitation framework for CVE-2026-75604 that enables authorized penetration testers to validate Next.js Windows cache traversal vulnerabilitie…

CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing

Research lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.

Windows Error Reporting ALPC Elevation of Privilege (CVE-2026-20817) - Proof-of-Concept exploit demonstrating local privilege escalation via WER service.

PoC for CVE-2026-20817

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandb…

eprocess offset puller for relevant member offsets and function addresses for cve-2026-40369

CVE-2026-40369

CVE-2026-40369本地权限提升漏洞exp

Exploit inspired by `https://voidsec.com/cve-2026-40369-browser-sandbox-escape/`. Use Feature_RestrictKernelAddressLeak and forge token to Elevate privileges

POC pre-auth RCE on Exchange

RCE exploit for CVE-2023-3519

Passively fingerprint Citrix ADC / NetScaler ADC & Gateway builds and detect known CVEs — CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and CVE-2026-88771/887…

Citrix Scanner for CVE-2023-3519

CVE-2023-3519 vuln for nuclei scanner

Citrix ADC RCE CVE-2023-3519

Stack-Overflow on Citrix

CVE-2026-42980 PUBLIC EXPLOIT + RESEARCH

PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare

CVE-2026-46331

CVE-2026-46331 and CVE-2026-43503

CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9

CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix

pedit COW

CVE-2026-46331 - Draft

cve-2026-46331-audit script

POC exploit for CVE-2024-49138

SOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated environment.

Hands-on SOC investigation of CVE-2024-49138 using LetsDefend, VirusTotal, Hybrid Analysis, TrueFort, and ChatGPT.

In this lab I walked through an end-to-end intrusion that began with an external RDP break-in, used a brand-new CLFS privilege-escalation exploit (CVE-2024–491…

Proof of concept & details for CVE-2025-21298

A Critical Windows OLE Zero-Click Vulnerability. This is a proof-of-concept for CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability (CVSS 9.8). Th…

Complete analysis of CVE-2025-21298, a double free vulnerability related to ole32 library in windows.

Technical investigation and host containment of a Critical-severity Zero-Click RCE exploit (CVE-2025-21298) using EDR telemetry and static malware analysis.

LetsDefend SOC336 case study on CVE-2025-21298

SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough

LetsDefend SOC lab investigating CVE-2025-21298 Windows OLE Zero-Click RCE exploitation.

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)

Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

CVE-2021-1675 Detection Info

PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。

CVE-2021-1675 (PrintNightmare)

PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527

AD AutoPwn v4.13.0 — automated AD attack chain, zero-auth to Domain Admin. Discover/Kerberoast/AS-REP/AD CS ESC1-16/Shadow Creds/RBCD+KCD/Ghost-SPN/TGS-rewrite…

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerabilit…

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerabilit…

Fix URL containing SPACES after Apache upgrade CVE-2023-25690

A comprehensive collection of 12 containerized web exploitation challenges covering CVE-2023-25690, WebAuthn bypasses, HTTP/3 smuggling, and advanced XSS/RCE c…

HTTP Request Smuggling lab: Apache 2.4.55 CRLF injection

Python exploit for CVE-2023-25690 — Apache HTTP Request Smuggling via CRLF injection in mod_rewrite/mod_proxy. Built and tested against TryHackMe's Contrabando…

CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File

Windows File Explorer Spoofing Vulnerability (CVE-2025-24071)

Metasploit module for CVE-2025-24071 - Windows NTLM Hash Leak via .library-ms

A PoC of CVE-2025-24071 / CVE-2025-24054, A windows vulnerability that allow get NTMLv2 hashes

Exploited CVE-2025-24071 via SMB by hosting a .library-ms file inside a .tar archive. Using tar x from smbclient, the payload is extracted server-side without …

CVE-2025-24071 Proof Of Concept

Security Vulnerability Report: CVE-2025-24071 - Windows File Explorer Spoofing Vulnerability

Alternativa CVE-2025-24071_PoC

CVE-2020-15368, aka "How to exploit a vulnerable driver"

arbitrary code execution with CVE-2020-15368

Reverse engineering research of ASRock AsrDrv103.sys (CVE-2020-15368), covering its driver interface, encrypted request protocol, and privileged hardware acces…

CVE-2021-40444 PoC

CVE-2021-40444 - Fully Weaponized Microsoft Office Word RCE Exploit

This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

Modified code so that we don´t need to rely on CAB archives

CVE-2021-40444

Microsoft MSHTML Remote Code Execution Vulnerability CVE-2021-40444

A method for CVE-2025-31710 and to connect to cmd_skt to obtain a root shell on unisoc unpatched models

WPair is a defensive security research tool that demonstrates the CVE-2025-36911 (eg WhisperPair) vulnerability in Google's Fast Pair protocol. This vulnerabil…

Hijacking Bluetooth Accessories Using Google Fast Pair: WhisperPair CVE-2025-36911 Reference Implementation & Vulnerability Verification Toolkit

The official reference implementation & vulnerability verification of our attack WhisperPair (CVE-2025-36911) which affects Google's Fast Pair protocol.

Three-stage Bluetooth BDADDR extraction, DoS & hijack on Fast Pair devices; unpatched primitives outside CVE-2025-36911 scope (no Ubertooth needed)

Exploit of the CVE-2025-36911 vulnerability in Python for testing our own equipment

WhisperPair (CVE-2025-36911) POC for ESP32 device

A security research tool that identifies and demonstrates the CVE-2025-36911: Fast Pair Pairing Mode Bypass vulnerability

This script can be used to check if a Bluetooth device is vulnerable to CVE-2025-36911.

This is a one-time signature verification bypass. For persistent signature verification bypass, check https://github.com/TomKing062/CVE-2022-38691_38692

Bootloader unlock using CVE-2022-38694 for Anbernic Unisoc T820 devices

CVE-2022-38694 Hardened Exploit - RP2350 USB Host Auto Flasher for Unisoc devices

Unlock Bootloader for Itel S23 (S665L) / Unisoc T606 using CVE-2022-38694

rooting an ATOZEE P12 on Android 14 using CVE-2022-38694 — because fastboot oem unlock said no, so we found another way.

This is a collection of Unisoc BootROMs dumped from various Unisoc chipsets via CVE-2022-38694

Bootloader unlock (CVE-2022-38694) & root guide for Realme C53 / RMX3760 (Unisoc T612)

Extract a concerning amount of user information from Unisoc ZTE devices using CVE-2022-38694.

CVE-2025-32433 https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2

The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication.

CVE-2025-32433 PoC: Unauthenticated Remote Code Execution (RCE) in Erlang/OTP SSH. A proof-of-concept exploit for CVE-2025-32433

python script to find vulnerable targets of CVE-2025-32433

Security research on Erlang/OTP SSH CVE-2025-32433.

Missing Authentication for Critical Function (CWE-306)-Exploit

Exploit and detect tools for CVE-2020-0688

cve-2020-0688

cve-2020-0688

CVE-2020-0688_EXP Auto trigger payload & encrypt method

CVE-2020-0688 - Exchange

Quick tool for checking CVE-2020-0688 on multiple hosts with a non-intrusive method.

cve-2020-0688 UNIVERSAL Python implementation utilizing ASPX webshell for command output

Remote Code Execution on Microsoft Exchange Server through fixed cryptographic keys

Sudo Baron Samedit Exploit

PoC for CVE-2021-3156 (sudo heap overflow)

CVE-2021-3156 - Sudo Baron Samedit

CVE-2021-3156非交互式执行命令

Root shell PoC for CVE-2021-3156

CVE-2021-3156

clif is a command-line interface (CLI) application fuzzer, pretty much what wfuzz or ffuf are for web. It was inspired by sudo vulnerability CVE-2021-3156 and …