Every new exploit,
on the radar.

This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlan…

CVE-2026-15409/15410 SonicWall SMA1000 multi-exploit Framework - SSRF→Erlang RPC→RCE→root privesc. Features: --detect safe check, --exec, --read-file, --prives…

CVE-2026-15409

Proof-of-Concept exploit for CVE-2026-15409 (SonicWall SMA 1000 RCE) via Erlang distribution over WebSocket. Achieves unauthenticated remote code execution as …

CVE-2026-15409 - Dectect

Unofficial Bash IoC checker for SonicWall SMA1000 appliances affected by actively exploited CVE-2026-15409 and CVE-2026-15410.

poc for CVE-2024-38063 (RCE in tcpip.sys)

Note: I am not responsible for any bad act. This is written by Chirag Artani to demonstrate the vulnerability.

CVE-2024-38063 is a critical security vulnerability in the Windows TCP/IP stack that allows for remote code execution (RCE)

mitigation script by disabling ipv6 of all interfaces

potential memory corruption vulnerabilities in IPv6 networks.

Windows TCP/IP IPv6(CVE-2024-38063)

Vulnerability CVE-2024-38063

CVE-2025-8088 WinRAR Proof of Concept (PoC-Exploit)

Advanced WinRAR Path Traversal Exploit Tool for CVE-2025-8088

A sophisticated GUI tool for creating malicious RAR archives that exploit the WinRAR path traversal vulnerability (CVE-2025-8088) using ADS and RAR5 header man…

WinRAR 0day CVE-2025-8088 PoC RAR Archive

Exploit systems using older WinRAR without knowing their username (unlike other projects)

CVE-2025-8088-BUILDER

An engaging walkthrough on uncovering, patching, and securing the WinRAR CVE-2025-8088 with a hands-on hacker’s twist.

Python tool for safe archive handling, path traversal awareness, and secure extraction. Inspired by CVE-2025-8088.

CVE-2026-38526 | Krayin CRM v2.2.x Authenticated RCE - Unrestricted PHP File Upload via TinyMCE

CVE-2026-38526 exploit for Krayin CRM v2.2.x - Authenticated RCE via TinyMCE file upload bypass. Features interactive shell, multi-type payloads, auto shell ge…

Proof of Concept of CVE-2026-38526 in Krayin CRM <= v2.2.x. Arbitrary File Upload leading to Remote Code Execution

PoC and write-up for the HackTheBox "Nexus" privilege escalation: root-run Gitea template-sync service vulnerable to path traversal via forged Git objects. Edu…

HTB_Nexus Penetration Test Report – Comprehensive security assessment documenting credential leakage from Gitea, CVE-2026-38526 exploitation in Krayin CRM, and…

Exploit for Authenticated Remote Code Execution (RCE) in Krayin CRM v2.2.x (CVE-2026-38526)

Automated exploit for Krayin CRM ≤ 2.2.x.

A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x

CVE-2026-41651 — PackageKit TOCTOU LPE

CVE-2026-41651

Poc for Pack2TheRoot CVE-2026-41651

CTF-style Docker lab for CVE-2026-41651 (Pack2TheRoot): PackageKit permissive-polkit local privilege escalation

Exploit for CVE-2026-41651 - PackageKit TOCTOU Local Privilege Escalation (Pack2TheRoot)

CVE-2026-75604 Next.js Windows RCE poc

A Python-based exploitation framework for CVE-2026-75604 that enables authorized penetration testers to validate Next.js Windows cache traversal vulnerabilitie…

CVE-2026-75604 (Next.js Windows RCE) PoC - unauthenticated RCE via cache path traversal + forged Server Action; for authorized security testing

Research lab and exploit chain for CVE-2026-75604: path traversal in the Next.js incremental cache, to RCE on Windows.

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandb…

eprocess offset puller for relevant member offsets and function addresses for cve-2026-40369

CVE-2026-40369

CVE-2026-40369本地权限提升漏洞exp

Exploit inspired by `https://voidsec.com/cve-2026-40369-browser-sandbox-escape/`. Use Feature_RestrictKernelAddressLeak and forge token to Elevate privileges

Combined PoC for CVE-2025-28434 and CVE-2025-59528

CVE-2025-58434 and CVE-2025-59528 chain POC

Exploitation Silentium HTB-CTF

Critical unauthenticated kill chain leading to full RCE in FlowiseAI (CVE-2025-58434 + CVE-2025-59528)

Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password endpoint to change any user's password without prior …

The forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This e…

FlowiseAI CVE-2025-58434 & CVE-2025-59528 exploit PoC, demonstrating unauthenticated ATO via reset token leakage, followed by authenticated RCE. Includes a rep…

Passively fingerprint Citrix ADC / NetScaler ADC & Gateway builds and detect known CVEs — CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and CVE-2026-88771/887…

CVE-2026-8452 PreAuth RCE

Safely detect Citrix NetScaler CVE-2026-8452

CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, e…

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

RCE exploit for CVE-2023-3519

Passively fingerprint Citrix ADC / NetScaler ADC & Gateway builds and detect known CVEs — CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and CVE-2026-88771/887…

Citrix Scanner for CVE-2023-3519

CVE-2023-3519 vuln for nuclei scanner

Citrix ADC RCE CVE-2023-3519

Stack-Overflow on Citrix

test

Create PoC for CVE-2025-67303

Git CVE-2025-67303 payload

CVE-2026-22777 ComfyUI-Manager CRLF Injection leading to RCE chained with CVE-2025-67303

Exploit for Pterodactyl Panel ≤ 1.11.10 - unauthenticated LFI to RCE.

A script that gives you the credentials of a Pterodactyl panel vulnerable to CVE-2025-49132

PoCs for CVE-2025-49132

Pterodactyl翼龙面板CVE-2025-49132批量检测☝️🤓

This repository contains a Proof of Concept (PoC) for CVE-2025-49132, a critical vulnerability in Pterodactyl Panel versions < 1.11.11.

CVE For Pterodactyl (For Study and Education)

CVE-2026-64600

A C-based Linux security utility for detecting, safely verifying (Proof of Concept), and mitigating CVE-2026-64600 (RefluXFS). It provides kernel vulnerability…

A POC for the recently discovered Qualys bug on COW with XFS

A Linux kernel local privilege escalation affecting the XFS filesystem copy-on-write (CoW) path.

CVE-2026-64600 - Draft - Check todo

is an advanced security research framework designed to model, analyze, and demonstrate Local Privilege Escalation (LPE) mechanics associated with kernel-level …

PACKET_EDIT_MEME.c (aka CVE-2026-46331): yet another page cache poisoning nightmare

CVE-2026-46331

CVE-2026-46331 and CVE-2026-43503

CVE-2026-46331 — Linux Kernel Local Privilege Escalation TC pedit + IPsec TEE Page Cache Corruption · Affected kernels: ≤ 6.12.9

CVE-2026-46331 act_pedit page-cache corruption exploit, with Alpine PIE fix

pedit COW

CVE-2026-46331 - Draft

cve-2026-46331-audit script

PoC for CVE-2024-37054

NiteeshPujari/CVE-2024-37054, This repository contains a Proof of Concept (PoC) a critical deserialization vulnerability in MLflow that allows for Remote Code …

CVE-2024-37054 exploit and documentation

Generic PoC for MLflow pickle deserialization RCE (CVE-2024-37054-style). Poisons a registered model via the MLflow REST API to achieve code execution when the…

MLFlow unsafe deserialization (CVE-2024-37054) written for HTB machine - SmartHire

CVE-2026-0073 - ADB Wireless Mutual Authentication Bypass PoC

An automated exploit for CVE-2026-0073 (Android ADB TLS Auth Bypass). Features a built-in mDNS/Zeroconf scanner to instantly discover randomized Wireless Debug…

CVE-2026-0073 — Android ADB daemon (adbd) TLS authentication bypass via EVP_PKEY_cmp type confusion. Gain unauthorized shell access over WiFi using EC/Ed25519 …

CVE-2026-0073 – Android ADB Wireless Debugging Auth Bypass (CVSS 8.8) | Zero-click TLS type confusion to unauthenticated shell. 2 tools: Full Exploit (ADB shel…

A PoC tool for the CVE-2026-0073 on android 11+ devices which allows instant zero click RCE on any unpatched device with adb over tcp enabled

CVE-2026-0073 is an RCE with a CVSS severity score of 8.3, and here we will explain how it works.

CVE-2026-0073

Security-hardened fork of OpenCode - Fixes CVE-2026-22812 (CVSS 8.8 RCE) that upstream refuses to patch

OpenCode < v1.0.216 - Unauthenticated RCE

CVE-2026-22812 - OpenCode Unauth RCE

Open security research on AI coding agent infrastructure. Agent-executable remediation manifests for CVE-2026-22812 and CVE-2026-22813.

CVE-2026-22812

POC exploit for CVE-2024-49138

SOC investigation of CVE-2024-49138 exploitation alert involving PowerShell, EDRFreeze execution, and defense evasion behavior in a simulated environment.

Hands-on SOC investigation of CVE-2024-49138 using LetsDefend, VirusTotal, Hybrid Analysis, TrueFort, and ChatGPT.

In this lab I walked through an end-to-end intrusion that began with an external RDP break-in, used a brand-new CLFS privilege-escalation exploit (CVE-2024–491…

Proof of concept & details for CVE-2025-21298

A Critical Windows OLE Zero-Click Vulnerability. This is a proof-of-concept for CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability (CVSS 9.8). Th…

Complete analysis of CVE-2025-21298, a double free vulnerability related to ole32 library in windows.

Technical investigation and host containment of a Critical-severity Zero-Click RCE exploit (CVE-2025-21298) using EDR telemetry and static malware analysis.

LetsDefend SOC336 case study on CVE-2025-21298

SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298) Walkthrough

LetsDefend SOC lab investigating CVE-2025-21298 Windows OLE Zero-Click RCE exploitation.

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)

Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

CVE-2021-1675 Detection Info

PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。

CVE-2021-1675 (PrintNightmare)

PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerabilit…

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerabilit…

Fix URL containing SPACES after Apache upgrade CVE-2023-25690

A comprehensive collection of 12 containerized web exploitation challenges covering CVE-2023-25690, WebAuthn bypasses, HTTP/3 smuggling, and advanced XSS/RCE c…

HTTP Request Smuggling lab: Apache 2.4.55 CRLF injection

Python exploit for CVE-2023-25690 — Apache HTTP Request Smuggling via CRLF injection in mod_rewrite/mod_proxy. Built and tested against TryHackMe's Contrabando…

CVE-2026-8461

CVE-2026-8461 - Draft

A lab setup to test cve-2026-8461

FreePascal implementation of the UnrealIRCD CVE-2010-2075

Exploit for CVE:2010-2075. This exploit allows remote command execution in UnrealIRCd 3.2.8.1.

CVE-2010-2075 exploit

UnrealIRCd 3.2.8.1 backdoor command execution exploit in Python 3 (CVE-2010-2075).

Script that exploits the vulnerability that allows establishing a backdoor in the UnrealIRCd service with CVE-2010-2075

CVE-2010-2075

Technical writeup and penetration testing report for CVE-2010-2075, demonstrating UnrealIRCd backdoor exploitation and remediation.

Controlled PenTest lab report for UnrealIRCd 3.2.8.1 backdoor (CVE-2010-2075) on Metasploitable3 with remediation steps.

A Tool For CVE-2023-49070/CVE-2023-51467 Attack

Authentication Bypass Vulnerability Apache OFBiz < 18.12.10.

Exploit Of Pre-auth RCE in Apache Ofbiz!!

CVE-2023-49070 exploit and CVE-2023-49070 & CVE-2023-51467 vulnerability scanner

This exploit scans whether the provided target is vulnerable to CVE-2023-49070/CVE-2023-51467 and also exploits it depending on the choice of the user.

Apache OFBiz XML-RPC pre-auth deserialization RCE PoC (CVE-2023-49070) — auth bypass + ysoserial gadget chain via /webtools/control/xmlrpc

CVE-2018-9276 PRTG < 18.2.39 Authenticated Command Injection (Reverse Shell)

CVE-2018-9276 PRTG < 18.2.39 Reverse Shell (Python3 support)

Python Exploit for CVE: 2018-9276

CVE-2018-9276 — PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.