Every new exploit,
on the radar.

CVE-2019-9978 - (PoC) RCE in Social WarFare Plugin (<=3.5.2)

CVE-2019-9978 - RCE on a Wordpress plugin: Social Warfare < 3.5.3

Wordpress Social Warfare Remote Code Execution (AUTO UPLOAD SHELL)

Remote Code Execution in Social Warfare Plugin before 3.5.3 for Wordpress.

POC (RCE) -> CVE-2019-9978

Social WarFare Plugin (<=3.5.2) Remote Code Execution

A complete walkthrough and exploit for CVE-2019-9978 - Unauthenticated Remote Code Execution in Social Warfare WordPress plugin ≤ 3.5.2. Includes vulnerable co…

A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting versions below 3.5.3.

CVE-2026-54390 — JTL Shop Smarty SSTI RCE | Pre-Auth Template Injection via fetch('string:' . ) | 5.2.0-5.7.1

Reproducer for CVE-2026-40860 — Apache Camel camel-jms/sjms/amqp JMS ObjectMessage unsafe deserialization (RCE)

CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass

Reproducer for CVE-2026-40859 — Apache Camel camel-netty-http / camel-vertx-http producer-side unsafe deserialization of HTTP response bodies (RCE)

CVE-2025-51482 POC, Dump Credentials From zm.Users

Reproducer for CVE-2026-40858 — Apache Camel camel-infinispan remote aggregation repository unsafe deserialization (RCE)

oPanel DNS-Based Cross-Site Scripting (XSS) & Session Hijacking

oPanel Authanticated Remote Code Execution via 'advenced/curl' Component

Proof of Concept for Reflected XSS in Lucee CFML (CVE-2026-29519)

PoC for CVE-2026-56423: MISP deleteSelection broken access control (CWE-862, contributor hard-deletes other orgs' Event Reports/Sharing Groups, CVSS 8.8)

POC CVE-2025-40778: Cache Poisoning BIND 9 👾

Forensic triage of DNS cache poisoning in legacy hardware. Includes PCAP analysis of 839-byte unsolicited record injections, CVE-2025-40778 mapping, and remedi…

Proof of Concept for CVE-2025-40778: BIND 9 DNS Cache Poisoning via unsolicited Additional Section records.

A vulnerability in fiberhome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the S…

This is a Proof-Of-Concept of CVE-2025-63353

CVE-2025-63353

Multi-language PoC (Python · Go · JS · C) and technical documentation for CVE-2025-63353, a critical predictable-default-PSK vulnerability in FiberHome HG6145F…

PoC for CVE-2026-49230: Apache APISIX jwe-decrypt authentication bypass (missing AES-GCM tag validation, CWE-354, CVSS 9.1)

Librebooking Admin RCE PoC CVE-2026-61343

The VTEX Checkout Service exposes OrderForm data through the endpoints `/api/checkout/pub/orderForm/{orderFormId}` and `/attachments/*`. These endpoints do not…

💉 Blind SQL Injection → RCE exploit for Control Web Panel (CWP) ≤ 0.9.8.1224 — userRes POST → INTO DUMPFILE → cwpsvc shell

Control Web Panel (CWP) vulnerability scenario related to CVE-2026-57517

CVE-2025-44203 - HotelDruid 3.0.0/3.0.7 - Sensitive Information Disclosure, DoS

Offical PoC for this cve

CVE-2026-8037 - Draft

包括能执行的命令探测和一键getshell（需要服务器部署服务）

Public disclosure for CVE-2026-52100 (CSRF) & CVE-2026-52101 (SSRF) in linx-server. MITRE assigned the CVEs; this repo provides a public reference and helps af…