Every new exploit,
on the radar.

Batch upgrade all your Next.js apps to patched versions - fight back against CVE-2025-55183/55184/67779

PoC for CVE-2025-55183

Security research lab for CVE-2025-55183 and CVE-2025-55184 in React Server Components

CVE-2025-55183 POC

A CVE-2025-55183 secret miner

CVE-2025-55183 Scanner

Exploit for CVE-2025-11001 or CVE-2025-11002

CVE-2025-11001 (CVSS 7.0) – 7-Zip < 25.00 Directory Traversal → RCE via crafted ZIP with symlink. Allows arbitrary file write when extracted as Administrator. …

A scanner and testter of the CVE-2025-11001 of 7-zip

Exploit for CVE-2025-11001

Unauthenticated Remote Code Execution in SPIP versions up to and including 4.2.12

Unauthenticated Remote Code Execution in SPIP versions up to and including 4.2.12

This exploit will attempt to execute system commands on SPIP targets.

The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthentic…

Exploitation of a Remote Code Execution vulnerability- (CVE-2024-7954)

SPIP 4.30-alpha2、4.2.13、4.1.16之前的版本使用的porte_plume插件存在任意代码执行漏洞，远程未经身份验证的攻击者可以通过发送精心设计的HTTP 请求以SPIP用户身份执行任意PHP代码。

RCE exploit for a .NET JSON deserialization vulnerability in Telerik UI for ASP.NET AJAX.

Telerik UI for ASP.NET AJAX File upload and .NET deserialisation exploit (CVE-2017-11317, CVE-2017-11357, CVE-2019-18935)

[CVE-2019-18935] Telerik UI for ASP.NET AJAX (RadAsyncUpload Handler) .NET JSON Deserialization

TelerikUI Vulnerability Scanner (CVE-2019-18935)

CVE-2019-18935

This project for CVE-2019-18935

CVE-2024-41570: Havoc C2 0.7 Teamserver SSRF exploit

Havoc SSRF to RCE

Automated Reverse Shell Exploit via WebSocket | Havoc-C2-SSRF with RCE

This is a modified version of the CVE-2024-41570 SSRF PoC from @chebuya chained with the auth RCE exploit from @hyperreality. This exploit executes code remote…

This is a Chained RCE in the Havoc C2 framework using github.com/chebuya and github.com/IncludeSecurity pocs

Expanded Exploit based on CVE-2024-41570

Apache forward request CVE

CVE-2021-40438 exploit PoC with Docker setup.

CVE-2021-40438 Apache <= 2.4.48 SSRF exploit

Sigma-Rule-for-CVE-2021-40438-Attack-Attemp

check CVE-2021-40438

Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery

Exploit to SYSTEM for CVE-2021-21551

Cobalt Strike (CS) Beacon Object File (BOF) foundation for kernel exploitation using CVE-2021-21551.

arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system

Dell Driver EoP (CVE-2021-21551)

Dell Driver EoP (CVE-2021-21551)

An extended proof-of-concept for the CVE-2021-21551 Dell ‘dbutil_2_3.sys’ Kernel Exploit

Proof of concept exploit for CVE-2021-21551

original cve-2013-2094 exploit and a rewritten version for educational purposes

CVE-2013-2094 exploit for android

CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERF_EVENTS local root x86/x86_64

CVE-2013-2094 kernel exploit for i386

perf_swevent_init

A vulnerability scanner that detects CVE-2021-21980 vulnerabilities.

Realistic vulnerable lab for CVE-2021-21980 (VMware vSphere Path Traversal) - Actual file exploitation, not a mock server

A vulnerability scanner that detects CVE-2021-21980 vulnerabilities.

Nuclei Template and Mock Server for CVE-2021-21980 (vSphere Path Traversal)

Nuclei Template and Mock Server for CVE-2021-21980 (vSphere Path Traversal)

CVE-2021-21980

远程代码执行S2-062 CVE-2021-31805验证POC

S2-062 (CVE-2021-31805) / S2-061 / S2-059 RCE

Apache Struts2 S2-062远程代码执行漏洞(CVE-2021-31805) 支持批量扫描漏洞及漏洞利用

Apache Struts2 S2-062远程代码执行漏洞(CVE-2021-31805) | 反弹Shell

PoC for CVE-2021-31805 (Apache Struts2)

S2-061/S2-062 Struts2 远程命令执行漏洞 POC&EXP

Apache Struts2 S2-062(CVE-2021-31805)远程代码执行批量检测（无利用）

Vulnerable environment of CVE-2021-31805 (S2-062) for testing

CVE-2020-26217 XStream RCE POC

CVE-2020-26217 && XStream RCE

CVE-2020-26217 XStream反序列化的poc

xstream with CVE-2020-26217

CVE-2024-10220 Test repo

CVE-2024-10220 POC

CVE-2024-10220 reveals a critical flaw in Kubernetes’ deprecated gitRepo volume type, allowing attackers to execute arbitrary commands via malicious .hooks scr…

Testing CVE-2024-10220 for HPC security research

Analysis and reproduction of CVE-2025-57833

We've set up an environment to test CVE-2025-57833. This environment was built using AI, so it's subject to ongoing modification.

Example Vulnerable application for CVE-2025–57833

CVE-2025-57833 PoC (취약한 도서 검색 서비스)

Directory transversal to remote code execution

CVE-2019-16728 Proof of Concept

A quick python exploit for the Nostromo 1.9.6 remote code execution vulnerability. Simply takes a host and port that the web server is running on.

Python script to exploit RCE in Nostromo nhttpd <= 1.9.6.

CVE-2019-16278Nostromo httpd命令执行

PoC RCE exploit for Nostromo nhttpd ≤ 1.9.6

CVE-2019-16278 Python3 Exploit Code

(Nhttpd) Nostromo 1.9.6 RCE due to Directory Traversal

CVE-2025-6554

poc for CVE-2025-6554

A go-exploit to scan for Juniper firewalls vulnerable to CVE-2023-36845

Juniper Firewalls CVE-2023-36845 - RCE

Simple Automation script for juniper cve-2023-36845

CVES

CVE-2023-36845 - Juniper Firewall Remote code execution (RCE)

CVE-2023-36845 PoC script automates the PoC for CVE-2023-36845 targeting Juniper Networks Junos OS's J-Web component on EX and SRX Series devices. It exploits …

Improved DOS exploit for wordpress websites (CVE-2018-6389)

CVE-2018-6389 Exploit In WordPress DoS

Mitigate CVE-2018-6389 WordPress load-scripts / load-styles attacks

WordPress DoS (CVE-2018-6389)

PoC Exploit CVE-2018-6389

Exploit for vulnerability CVE-2018-6389 on wordpress sites

CVE-2018-6389: WordPress <= 4.9.x 拒绝服务(DOS)漏洞

Metasploit module for WordPress DOS load-scripts.php CVE-2018-638

OpenSSH 9.1 vulnerability mass scan and exploit

OpenSSH Pre-Auth Double Free CVE-2023-25136 POC

OpenSSH 9.1 vulnerability mass scan and exploit

OpenSSH 9.1漏洞大规模扫描和利用

CVE-2023-25136 POC written by axylisdead

OpenSSH Pre-Auth Double Free CVE-2023-25136 – Writeup and Proof-of-Concept

Linux 4.10 < 5.1.17 PTRACE_TRACEME local root

The exploit for CVE-2019-13272

linux 提权

Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287/Google Android - 'Stagefright' Remote Code Execution - CVE-2015-1538

This is a Python 3 version of this exploit. Hope it works!!!

Es una vulnerabilidad para escalar privilegios en linux.

提权漏洞

Local Root vulnerability- CVE-2019-13272 / Security Bypass Vulnerability – CVE-2019-14287

CVE-2023-46818 IPSConfig Python exploit

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is ena…

CVE-2023-46818 Python3 Exploit for ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability

This is my own exploit for CVE-2023-46818 happy hacking!

CVE-2023-46818 - ISPConfig PHP Code Injection PoC Exploit (Bash)

CVE-2023-46818 Python3 Exploit for Backdrop CMS <= 1.22.0 Authenticated Remote Command Execution (RCE)

CVE-2023-46818 | PoC | ISPConfig 3.2.11p1

Proof-of-Concept of CVE-2023-45612

PoC for CVE-2023-45612

Ktor XXE Injection Proof-of-Concept (CVE-2023-45612)

Reproduction of a high severty security problem that allows XXE (XML eXternal Entity) attacks on Ktor's XML serialization.

This repository provides a Proof of Concept for CVE-2023-45612, demonstrating an XML External Entity (XXE) injection vulnerability in JetBrains Ktor versions p…

CVE-2023-45612 POC and vulnerable project.

Proof of concept for XXE in Ktor (CVE-2023-45612)

POC - WordPress File Upload plugin, in the wfu_file_downloader.php file before version <= 4.24.11

WordPress File Upload插件任意文件读取漏洞（CVE-2024-9047）批量检测脚本

Exploit for WordPress File Upload Plugin - All versions up to 4.24.11 are vulnerable.

CVE-2024-9047, wfu_file_downloader.php

CVE-2024-9047

remote code exec for git

Python script for exploiting command injection in Open PLC Webserver v3

proof of Concept (PoC) exploit for CVE-2021-31630, targeting the OpenPLC service running on the WifineticTwo box on the Hack The Box platform.

Exploit for Authenticated Remote Code Execution on OpenPLC v3 Webserver

This is a automation of cve-2021-31630 exploitation

A simple python script to exploit CVE-2021-31630 on HTB WifineticTwo CTF

OpenPLC 3 WebServer Authenticated Remote Code Execution.

Modified the PoC CVE-2021-31630 script by Fellipe Oliveira for HTB

Git-lfs RCE exploit CVE-2020-27955 - tested on Windows on: git, gh cli, GitHub Desktop, Visual Studio, SourceTree etc.

cve-2020-27955

CVE-2020-27955 Poc

CVE-2020-27955