Every new exploit,
on the radar.

This repository provides a learning environment to understand how an Exim RCE exploit for CVE-2018-6789 works.

PoC materials to exploit CVE-2018-6789

Exim < 4.90.1 RCE Vulnerability remake for Python3 with arguments passed from CLI

CVE-2018-6789

CVE-2025-27591 is a privilege escalation vulnerability that affected the Below service before version 0.9.0

self cleaning CVE-2025-27591 Poc that grants a root reverse shell instead of modifying passwd files

CVE-2025-27591

CVE-2025-27591 is a known privilege escalation vulnerability in the Below service (version < v0.9.0)

A Proof of Concept for CVE-2025-27591, a local privilege escalation in Below < v0.9.0

Below v0.8.1 - Local Privilege Escalation (CVE-2025-27591) - PoC Exploit

a C exploit for CVE-2025-27591, which allow an attacker to escalate privilege to root.

🔥 Local Privilege Escalation Exploit for CVE-2025-27591 | Abuses world-writable log dir in Below to gain root via /etc/passwd injection

CVE-2024-28397: js2py sandbox escape, bypass pyimport restriction.

This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).

This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classe…

A Python automation script for exploiting the **js2py Sandbox Escape** vulnerability (CVE-2024-28397). This tool automates the payload generation and delivery …

Professional exploit for CVE-2024-28397: Js2Py Sandbox Escape leading to Remote Code Execution (RCE). Includes modular payload generation.

Reverse shell for CVE-2024-28397.

Proof of Concept for CVE-2019-18634

A functional exploit for CVE-2019-18634, a BSS overflow in sudo's pwfeedback feature that allows for for privesc

My n-day exploit for CVE-2019-18634 (local privilege escalation)

A reproduction of CVE-2019-18634, sudo privilege escalation with buffer overflow.

An Python Exploit for Sudo vulnerability CVE-2019-18634

exploit for sudo CVE-2019-18634

exploit

CVE-2023-38646 Metabase RCE

Automatic Tools For Metabase Exploit Known As CVE-2023-38646

POC for CVE-2023-38646

Metabase Pre-auth RCE (CVE-2023-38646)!!

Metabase Pre-auth RCE

Exploit script for Pre-Auth RCE in Metabase (CVE-2023-38646)

Metabase Pre-auth RCE (CVE-2023-38646)

For educational purposes only

PoC Exploit for the NTLM reflection SMB flaw.

Universal exploitation tool for CVE-2025-33073 targeting Windows Domain Controllers with DNSAdmins privileges and WinRM enabled.

Proof-of-Concept

cupntlm

PoC Exploit for the NTLM reflection SMB flaw.

This rough PoC checker script tests targets for CVE-2025-33073 vulnerability by attempting to perform NTLM reflection attacks using NTLM auth coercion via samb…

CVE-2019-5420 (Ruby on Rails)

A vulnerability can allow an attacker to guess the automatically generated development mode secret token.

Ruby反序列化命令执行漏洞（CVE-2019-5420）-vulfocus通关版

POC Exploit written in Ruby

cve-2019-5420 POC simple ruby script

cve-2019-5420

Apache Tomcat Remote Code Execution on Windows

Apache Tomcat Remote Code Execution on Windows - CGI-BIN

Vulnerability analysis and PoC for the Apache Tomcat - CGIServlet enableCmdLineArguments Remote Code Execution (RCE)

CVE-2019-0232-Remote Code Execution on Apache Tomcat 7.0.42

Hi this is a revised and enhanced code for CVE-2019-0232

An exploit for the Cisco Catalyst SD-WAN Controller authentication bypass vulnerability, CVE-2026-20127

Cisco Catalyst SD-WAN 身份验证绕过漏洞(CVE-2026-20127)利用EXP

Walkthrough of the CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN from first malformed peering request to root on the management plane.

Cisco SD-WAN Exposure & Potential Vulnerability Scanner (Passive Fingerprinting) 2026

CVE-2026-20127

A simple scanner for identifying vulnerable cups-browsed instances on your network

Unauthenticated RCE on cups-browsed (exploit and nuclei template)

Scanner

POC scanner for CVE-2024-47176

Ultrafast CUPS-browsed scanner (CVE-2024-47176)

Vulnerability Scanner for CUPS: CVE-2024-47176

A Mass Scanner designed to detect the CVE-2024-47176 vulnerability across systems running the Common Unix Printing System (CUPS).

CUPS Browsd Check_CVE-2024-47176

CVE-2019-9978 - (PoC) RCE in Social WarFare Plugin (<=3.5.2)

CVE-2019-9978 - RCE on a Wordpress plugin: Social Warfare < 3.5.3

Wordpress Social Warfare Remote Code Execution (AUTO UPLOAD SHELL)

Remote Code Execution in Social Warfare Plugin before 3.5.3 for Wordpress.

POC (RCE) -> CVE-2019-9978

Social WarFare Plugin (<=3.5.2) Remote Code Execution

A complete walkthrough and exploit for CVE-2019-9978 - Unauthenticated Remote Code Execution in Social Warfare WordPress plugin ≤ 3.5.2. Includes vulnerable co…

A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting versions below 3.5.3.

POC for CVE-2021-21974 VMWare ESXi RCE Exploit

自研针对ESXI 堆栈溢出的CVE-2021-21974 POC，只支持项目给出的的目标和环境，用于学习和研究

Analysis of the ransom demands from Shodan results

ESXi EZ - A custom scanner that takes list of IPs either in JSON, CSV or individually and checks for infection CVE-2021-21974

Nmap NSE script for cve-2021-21974

CVE-2021-21974 Vulnerability Detection Tool Safe PoC that identifies vulnerable SLP implementations without exploitation

CVE-2026-43503

Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption

Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, …

DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503

DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503

CVE-2021-40346 PoC (HAProxy HTTP Smuggling)

CVE-2021-40346 integer overflow enables http smuggling

HAProxy CVE-2021-40346

CVE-2021-40346 - HaProxy HTTP request smuggling through integer overflow

HTTP Request Smuggling

WHS CVE-2021-40346 분석

Apache CouchDB 3.2.1 - Remote Code Execution (RCE)

I wrote a blog post about Apache CouchDB CVE-2022-24706 RCE Exploits

CVE-2022-24706 POC exploit

Apache CouchDB 3.2.1 - Remote Code Execution (RCE) Checker

一款针对Vcenter的综合利用工具，包含目前最主流的CVE-2021-21972、CVE-2021-21985以及CVE-2021-22005、One Access的CVE-2022-22954、CVE-2022-22972/31656以及log4j，提供一键上传webshell，命令执行或者上传公钥使用SSH免密…

POC for VMWARE CVE-2022-22954

CVE-2022-22954 VMware Workspace ONE Access freemarker SSTI 漏洞 命令执行、批量检测脚本、文件写入

VMware Workspace ONE Access and Identity Manager RCE via SSTI - Test script for shodan, file or manual.

提供批量扫描URL以及执行命令功能。Workspace ONE Access 模板注入漏洞，可执行任意代码

CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspace ONE Access and Identity Manager

PoC for CVE-2022-22954 - VMware Workspace ONE Access Freemarker Server-Side Template Injection

PoC

This PoC targets CVE-2025-30065, an RCE vulnerability in Apache Parquet via Avro schema deserialization. It abuses the getDefaultValue() mechanism to instantia…

A CVSS 10.0-rated vulnerability in the parquet-avro Java module allows remote code execution via unsafe deserialization when parsing schemas. Tracked as CVE-20…

CVE-2025-30065 PoC

PoC: CVE-2025-30065 incomplete fix bypass in Apache Parquet Java 1.15.1

CVE-2022-46364-Poc Apache CXF SSRF via MTOM XOP:Include

This vulnerability allows an attacker to perform SSRF (Server-Side Request Forgery) attacks on Apache CXF webservices that accept MTOM/XOP requests. The issue …

Exploit CVE-2022-46363

CVE-2022-46364 Apache CXF XOP:Include SSRF / LFI

Python POC, Exploit for CVE-2022-46364

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user

Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)

Exploiting CVE-2021-42278 and CVE-2021-42287

Detection script for CVE-2021-42278 and CVE-2021-42287

Go implementation of NoPac, exploiting CVE-2021-42278 and CVE-2021-42287

Updated Exploit - pfBlockerNG <= 2.1.4_26 Unauth RCE (CVE-2022-31814)

CVE-2022-31814 Exploitation Toolkit.

pfBlockerNG <= 2.1.4_26 Unauth RCE (CVE-2022-31814)

CVE-2022-31814

pfBlockerNG <= 2.1.4_26 Unauth RCE (CVE-2022-31814)

Proof of concept for CVE-2022-31814

WSO2 RCE (CVE-2022-29464) exploit and writeup.

😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464.

A bots loader for CVE-2022-29464 with multithreading

Perform With Mass Exploits In WSO Management.

RCE exploit for WSO2

cve-2022-29464 批量脚本

WSO2 RCE (CVE-2022-29464)

Python script to exploit CVE-2022-29464 (mass mode)

Zimbra RCE simple poc

Zimbra CVE-2022-27925 PoC

A loader for zimbra 2022 rce (cve-2022-27925)

CVE-2022-27925

Python Script to exploit Zimbra Auth Bypass + RCE (CVE-2022-27925)

CVE-2022-27925 nuclei template

Proof of conept to exploit vulnerable proxycommand configurations on ssh clients (CVE-2023-51385)

一个验证对CVE-2023-51385

OpenSSH ProxyCommand RCE

CVE-2023-51385 PoC Exploit

CVE-2023-51385;OpenSSH ProxyCommand RCE;OpenSSH <9.6 命令注入漏洞poc

一个验证对CVE-2023-51385

Patch for CVE-2025-54236(a.k.a Session Reaper) which allows customer account takeover and RCE under certain conditions. This patch is actually a Magento 2 exte…

PoC Magento Session Reaper - CVE-2025-54236

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

cve-2025-54236 poc

SessionReaper-CVE-2025-54236

Ambiente Docker para demonstração prática da CVE-2025-54236 (SessionReaper): PHP Object Deserialization levando a RCE em Magento Open Source 2.4.7

Adobe Magento SessionReaper LFI Vulnerability

Spectre exploit

a list of BIOS/Firmware fixes adressing CVE-2017-5715, CVE-2017-5753, CVE-2017-5754

Assesses a system for the "speculative execution" vulnerabilities described in CVE-2017-5715, CVE-2017-5753, CVE-2017-5754

Research and hands-on PoC of Spectre Variant 2 (CVE-2017-5715), a hardware side-channel vulnerability exploiting CPU speculative execution and branch predictio…