Every new exploit,
on the radar.

PoC exploit for CVE-2018-11736 affecting Pluck CMS versions prior to 4.7.7-dev2 with a File Upload Vulnerability

WordPress WP_Query SQL Injection POC

Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment POC exploit

CVE-2022-21661 exp for Elementor custom skin.

Study and exploit the vulnerability CVE-2022-21661 that allows SQL Injections through plugins POST requests to WordPress versions below 5.8.3.

A Python PoC of CVE-2022-21661, inspired from z92g's Go PoC

Demonstration of the SQL injection vulnerability in wordpress 5.8.2

The first poc video presenting the sql injection test from ( WordPress Core 5.8.2-'WP_Query' / CVE-2022-21661)

Exploit POC code for CVE-2022-31898, a command injection for GL-iNet routers with firmware below 3.215

Authenticated Command Injection Tool (CVE-2022-31898) - HACKCONRD 2026.

CVE-2017-8869 - MediaCoder 0.8.48.5888 - Local Buffer Overflow (SEH)

CVE-2014-6287

a python3 version of the exploit written for CVE-2014-6287. Useful for completing the "Steel Mountain" room on TryHackMe.com without the use of metasploit.

HttpFileServer httpd 2.3

A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287

Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c

Rejetto http File Server 2.3.x (Reverse shell)

Jira未授权SSRF漏洞

https://jira.atlassian.com/browse/JRASERVER-69793

POC to check for Jira instances vulnerable to CVE-2019-8451

exploit for atlassian jira server SSRF

Wrapper in Python to exploit CVE-2024-51428 in ZoneMinder using Blind SQL Injection using sqlmap, automating enumeration of DBs, tables, and data extraction wi…

CVE-2024-34064 demo - v3 subtle vuln no misleading comment

CVE-2024-34064 demo - v4 subtle vuln good comment

CVE-2024-34064 demo - baseline (no sanitisation)

CVE-2024-34064 demo - v1 genuine fix honest comments

CVE-2024-34064 demo - v2 genuine fix bad comments

CVE-2024-34064 demo - v5 regex missing end anchor

CVE-2024-34064 demo - v6 sanitisation applied to wrong variable

This repo shows an exploit to CVE-2021-24762. This is an Blind SQLi exploit that, on default config, greps the admin password.

learning github

PoC for CVE-2026-29786 demonstrating a node-tar hardlink path traversal that allows overwriting files outside the extraction directory.

Technical analysis and Proof-of-Concept (PoC) for a critical Path Traversal vulnerability via Symlink manipulation in the Node.js 'tar' package (CVE-2026-29786)

PoC for CVE-2024-22393: Pixel Flood DoS in Apache Answer ≤1.2.1. Upload crafted 5KB image with fake 64Kx64K dimensions. Server allocates memory for 4B+ pixels …

ApacheHunter detects CVE-2024-22393 in Apache Answer servers. Like Wappalyzer but CLI-based. Scans headers, page content, meta tags, and paths to identify Apac…

Exploit for CVE-2024-22393 Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.

Detector de CVE-2026-21533: escalada de privilegios a SYSTEM en Servicios de Escritorio Remoto (RDS) de Windows.

CVE-2026-21533 Zaafiyet tarama aracı

Exploit tool for CVE-2021-43008 Adminer 1.0 up to 4.6.2 Arbitrary File Read vulnerability

Adminer CVE-2021-43008 PoC

Environnement de démonstration pour la vulnérabilité CVE-2021-43008 d’Adminer : observer l’impact réel et tester des mesures de mitigation.

VX Search Enterprise v10.1.12 Remote Buffer Overflow

Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover

Dockerized vulnerable lab demonstrating CVE-2024-2083 in ZenML, a path traversal vulnerability in the step logs API allowing arbitrary file read.

Local privilege escalation exploit for CVE-2025-62676.

CVE-2025-31651 PoC

this is poc test job

Reproduction lab for CVE-2026-3304 — async fileFilter race condition in Multer causes disk exhaustion via orphaned temp files

CVE-2024-56348 — JetBrains TeamCity <2024.12 auth bypass + RCE exploit (unauthenticated SYSTEM_ADMIN + shell)