Every new exploit,
on the radar.

Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559.

CVE-2007-4559 - Polemarch exploit

Bypass for CVE-2007-4559 Trellix patch

YISF 2024 CTF-Web (Directory Traversal via ".tar" file, CVE-2007-4559), easy

SQL injection via unsanitized QuerySet.order_by() input

A basic analysis about CVE-2021-35942. SQL injection in Django.

Reproduce CVE-2021-35042

Django SQL injection vulnerability

CVE-2024-24590 ClearML RCE&CMD POC

Proof of concept for CVE-2024-24590

CVE-2024-24590 – ClearML RCE via unsafe pickle artifact deserialization (0.17.0–1.14.2)

With this script you can exploit the CVE-2024-24590

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded ar…

Created this exploit for the Hack The Box machine, Blurry.

Proof of Concept demonstrating Remote Code Execution through insecure deserialization in Roundcube (CVE-2025-49113).

💥 Python Exploit for CVE-2025-49113 | Roundcube Webmail RCE via PHP Object Injection

Proof-of-concept to CVE-2025-49113

Detection for CVE-2025-49113

POC of CVE-2025-49113

CVE-2025-49113 - Roundcube <= 1.6.10 Post-Auth RCE via PHP Object Deserialization

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Recreation of the SharePoint PoC for CVE-2023-29357 in C# from LuemmelSec

A Python script that verifies whether a target is vulnerable to CVE-2023-29357 or not

Event ID 189 Rule Name SOC227 Microsoft SharePoint Server Elevation of Privilege Possible CVE-2023-29357 .. Exploitation

PoC for the recent critical vuln affecting OpenSSH versions < 9.3p2

Takeover Account OpenSSH

CVE-2023-38408 SSH Vulnerability Scanner & PoC

An in-depth analysis of CVE 2023 38408, a critical OpenSSH vulnerability, including technical background, exploitation in controlled environments, and mitigati…

CVE-2023-38408 Remote Code Execution in OpenSSH's forwarded ssh-agent

Script para eliminar vulnerabilidad de openssh de ubuntu 22.04 LTS

Slide and source code for CS-782 attack presentation

Vulnerability Overview CVE-2023-38408 affects OpenSSH versions < 9.3p2 and stems from improper validation of data when SSH agent forwarding is enabled. When us…

PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)

A PoC for CVE-2020-0601

CVE-2020-0601 #curveball - Alternative Key Calculator

Proof of Concept for CVE-2020-0601

Zeek package to detect CVE-2020-0601

这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，理解ECC算法、Windows验证机制，并尝试自己复现可执行文件签名证书和HTTPS劫持的例子。作为网络安全初学者，自己确实很菜，但希望坚持下去，加油！

PoC for CVE-2020-0601 - CryptoAPI exploit

Zeek package that uses OpenSSL to detect CVE-2020-0601 exploit attempts

Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1

Full unauthenticated RCE proof of concept for Rocket.Chat 3.12.1 CVE-2021-22911

CVE-2021-22911 Rocket.Chat NoSQL Injection RCE Exploit - Educational Purpose

Modifed ver of the original exploit to save some times on password reseting for unprivileged user

exploit for CVE-2021-22911 in rust

Command Execution PoC for OpenSSL Stack buffer overflow CVE-2025-15467

Working DoS for CVE-2025-15467 and a docker container to test against

discovery tool (powershell)

Exploit script for cve-2025-15467

IngressNightmare POC. world first non-blind remote execution exploitation with multi-advanced exploitation methods. allow on disk exploitation. CVE-2025-24514 …

CVE-2025-1974

Poc for Ingress RCE

PoC of CVE-2025-1974, modified from the world-first PoC~

PoC for CVE-2025-1974: Critical RCE in Ingress-NGINX (<v1.12.1) via unsafe config injection. Exploitable from the pod network without credentials, enabling cod…

POC IngressNightmare (CVE-2025-1974), modified from https://github.com/yoshino-s/CVE-2025-1974

Exploit CVE-2025-1974 with a single file.

CVE-2024-35250 的 Beacon Object File (BOF) 实现。

Cobalt Strike 的 CVE-2024-35250 的 BOF。(请给我加个星，谢谢。)

PoC for the Untrusted Pointer Dereference in the ks.sys driver

CVE-2024-35250 demonstrates that HVCI is not a defense against data-only kernel exploits. As long as a driver bug provides an arbitrary R/W primitive, token sw…

CVE-2024-35250 PoC - Optimized & Condensed Form of Varwara's PoC

Apache HugeGraph Server RCE Scanner ( CVE-2024-27348 )

Apache HugeGraph Server Unauthenticated RCE - CVE-2024-27348 Proof of concept Exploit

CVE-2024-27348 Exploitation Toolkit: Complete RCE exploit for Apache Huge-Graph-Server vulnerability.

This is a repository for Apache HugeGraph Remote Code Execution vulnerability(CVE-2024-27348))

SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4…

SPIP Vulnerability Scanner - CVE-2023-27372 Detector

This is a PoC for CVE-2023-27372 which spawns a fully interactive shell.

Perform With Mass Remote Code Execution In SPIP Version (4.2.1)

CVE-2023-27372-SPIP-CMS-Bypass

SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload)

Unauthenticated remote code execution vulnerability in SPIP before 4.2.1.

spip

PoC for CVE-2023-43208 RCE exploitation.

CVE-2023-43208: Mirth Connect Pre-Auth RCE PoC

A proof-of-concept exploit for CVE-2023-43208, a remote code execution vulnerability in Mirth Connect before version 4.4.1.

Use java.net.InetAddress for detection

Python implementation of CVE-2023-43208 Mirth Connect RCE (Unauth XStream)

PoC for Mirth Connect Remote Code Execution (RCE)

Proof‑of‑concept Python script demonstrating CVE‑2023‑43208 in Mirth Connect, allowing version checks and command execution on vulnerable instances.

针对JWT渗透开发的漏洞验证/密钥爆破工具，针对CVE-2015-9235/空白密钥/未验证签名攻击/CVE-2016-10555/CVE-2018-0114/CVE-2020-28042的结果生成用于FUZZ，也可使用字典/字符枚举(包括JJWT)的方式进行爆破(JWT Crack)

This repository contains the POC of an exploit for node-jose < 0.11.0

Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT.

Exploit for Node-jose < 0.11.0 written in Ruby

python2.7 script for JWT generation

POC for CVE-2018-0114 written in Go

Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist, and CVE-spec…

LPE PoC of a user-after-free vulnerability in the Linux netfilter subsystem.

CVE-2022-32250-LPE

My exploit for CVE-2022-32250 for linux kernel 5.18

Reproduce CVE-2022-32250 and CVE-2025-21756 by tampering with modprobe_path and hijacking control flow, respectively.

A Proof of Concept for chaining CVE-2025-6018 (PAM/Polkit Active Session Bypass) and CVE-2025-6019 (libblockdev SUID Mount Flaw) to achieve Local Privilege Esc…

CVE-2025-6018 + CVE-2025-6019 Privilege Escalation Exploit

Exploit for CVE-2025-6019

CVE-2025-6018 CVE-2025-6019 PoC Exploit - Local Privilege Escalation in openSUSE/SUSE Linux Enterprise 15 - PAM bypass + udisks2 XFS race condition LPE to root

Exploit Chain of CVE-2025-6018 to CVE-2025-6019

Auto exploit for CVE-2025-6018 & CVE-2025-6019 based on https://github.com/0rionCollector/Exploit-Chain-CVE-2025-6018-6019

This is just a quick note on how to exploit these vulnerabilities to get root.

Classic stack-based buffer overflow in SLMail 5.1 showing how early mail servers could be compromised through oversized SMTP and POP3 commands.

Exploit for CVE-2003-0264 based on pwntools and metasploit's windows/reverse_tcp

Exploit SLmail Buffer Overflow CVE-2003-0264

CVE-2003-0264 - SLMail 5.5 POP3 'PASS' Remote Buffer Overflow Vulnerability. Tested on Windows XP Professional SP3.

A POC remote buffer overflow for CVE-2003-0264 - SLMail 5.5

Buffer Overflow in Seattle Lab Mail (SLmail) 5.5 - POP3

CVE-2003-0264 SLMail5.5_RemoteBufferOverflow

Palo Alto Networks PAN-OS 身份验证绕过漏洞批量检测脚本(CVE-2025-0108)

PoC exploit for CVE-2025-0108 - PAN-OS Authentication Bypass

Detects an authentication bypass vulnerability in Palo Alto PAN-OS (CVE-2025-0108).

NSE script that checks for CVE-2025-0108 vulnerability in Palo Alto Networks PAN-OS

PAN-OS CVE POC SCRIPT

Debian OpenSSL Predictable PRNG (CVE-2008-0166)

Search for BTC coins on earlier versions of Bitcoin Core with critical vulnerability OpenSSL 0.9.8 CVE-2008-0166

Private keys vulnerable to Debian OpenSSL bug (CVE-2008-0166)

Debian OpenSSL Predictable PRNG (CVE-2008-0166)

Example script demonstrating a weak PRNG, CVE-2008-0166

A professional Python tool designed for educational penetration testing, demonstrating SSH vulnerabilities (CVE-2008-0166 / CVE-2008-1657) with interactive she…

SSH Exploit Tool (Educational Use Only) 📌 Description This tool demonstrates exploitation of: CVE-2008-0166 CVE-2008-1657 It connects to vulnerable SSH servi…

An exploit for Apache Struts CVE-2017-9805

CVE 2017-9805

Better Exploit Code For CVE 2017 9805 apache struts

Exploit script for Apache Struts2 REST Plugin XStream RCE (‎CVE-2017-9805)

An exploit for Apache Struts CVE-2017-9805

cve -2017-9805

CVE-2017-9805 POC

CVE-2017-9805 - Exploit

CVE-2022-21449 Proof of Concept demonstrating its usage with a client running on a vulnerable Java version and a malicious TLS server

Zeek script to detect exploitation attempts of CVE-2022-21449 targeting TLS clients

CVE-2022-21449 Vulnerability tester

Reappear-CVE-2022-21449-TLS-PoC

Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability checks, 100k secret wordlist, and CVE-spec…

Demos the Psychic Signatures vulnerability (CVE-2022-21449)

Test tool to demonstrate the vulnerability of CVE-2022-21449

Exploit PoC for CVE-2024-32002

CVE-2024-32002 RCE PoC

Hook for the PoC for exploiting CVE-2024-32002

local poc for CVE-2024-32002

Este script demuestra cómo explotar la vulnerabilidad CVE-2024-32002 para obtener una reverse shell, proporcionando acceso remoto al sistema afectado. Úselo co…

PoC of CVE-2024-32002 - Remote Code Execution while cloning special-crafted local repositories

Privilege Escalation script for CVE-2025-4517

Python tarfile data filter bypass via PATH_MAX overflow in os.path.realpath() - CVE-2025-4517 / CVE-2025-4330

CVE‑2025‑4517 Proof‑of‑Concept Script

CVE-2025-4517 (CVSS 9.4 – Critical) A vulnerability in Python's `tarfile`

Path traversal vulnerability in Python's tarfile.

A high-performance Python toolkit to automate the CVE-2025-4517 PATH_MAX bypass exploit. Specifically tuned for the WingData HTB challenge to achieve arbitrary…

PoC and explanation for CVE-2025-4517 used in a CTF I was playing.

Exploit for CVE-2024-6232 - Python Tarfile Realpath Overflow

Jenkins RCE Proof-of-Concept: SECURITY-1266 / CVE-2019-1003000 (Script Security), CVE-2019-1003001 (Pipeline: Groovy), CVE-2019-1003002 (Pipeline: Declarative)

CVE-2020-8012, CVE-2016-10709, CVE-2017-17099, CVE-2017-18047, CVE-2019-1003000, CVE-2018-1999002

A C# module to detect if a Jenkins server is vulnerable to the RCE vulnerability found in CVE-2019-1003000 (chained with CVE-2018-1000861 for pre-auth RCE)

Python CVE-2019-1003000 and CVE-2018-1999002 Pre-Auth RCE Jenkins