#1Tools for weaponizing vulnerabilities to gain unauthorized access to systems or data.
Kitploit recommended
dagowda/confluencec2This is a project aimed to make every other Saas product a C2, confluence is just the beginning.
cookiengineer/actual-php2shell🤖 NO, There is an easy way to exploit this vulnerability! (vibecoded to prove a point)
leonlai-tw/php-eol-cve-2026-109618-109619Unofficial patches for PHP CVE-2026-109618 / CVE-2026-109619 (RCE, CVSS 9.2) on EOL platforms: PHP 7.3 on CentOS/RHEL 7 (Remi), PHP 5.4 on Amazon…
horkimhab/cve-2025-64702-moreProof-of-concept code and research notes for QPACK/HTTP-3 vulnerabilities (CVE-2025-64702, CVE-2026-12523, CVE-2025-13945) for authorized lab testing.
horkimhab/cve-2026-109618-619Proof-of-concept code for CVE-2026-109618 and CVE-2026-109619 (php2shell bypass), packaged for authorized lab reproduction and vulnerability research.
yehia-mamdouh/xssya-v-2.0Python XSS scanner that confirms reflected and encoded-payload injection, executes payloads to capture cookies, detects WAFs, and tests XST with a…
eness/php2shell-cve-2026-109618-cve-2026-109619-pocProof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments.…
david-alvarez-rosa/php-rceExploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
automateforceai/cve-2018-0202Security & Privacy in Computing(Fall 2018), Final Group Project at JHUISI, clamscan vulnerability in Cisco's ClamAV 0.99.3
9bie/php2shell-bypass-aslr-expPure-HTTP exploit achieving RCE on PHP 8.4.26 + Apache mod_php via session upload_progress heap leak, dangling pointer reuse, and ASLR bypass to call…
oscerd/cve-2026-85316Runnable proof-of-concept reproducer for CVE-2026-85316, demonstrating unintended proxy mode in Apache Camel camel-platform-http path prefix…
oscerd/cve-2026-85317Runnable Spring Boot proof-of-concept reproducing CVE-2026-85317, where camel-http's OAuth2 token cache ignores scope, resource and token endpoint,…
oscerd/cve-2026-88900Runnable Spring Boot proof-of-concept reproducing CVE-2026-88900, the camel-jgroups unsafe Java deserialization flaw, showing affected versus patched…
oscerd/cve-2026-88901Runnable Spring Boot proof-of-concept reproducing CVE-2026-88901, an XXE (CWE-611) flaw in Apache Camel camel-smooks, with affected and patched…
dinosn/php-cve-2026-10961x-lab-pocPHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full…
4rdr/proofsCollection of CVE findings, proof-of-concept references, and vulnerability research notes, including ExploitDB entries and credited security…
oscerd/cve-2026-91858Runnable Spring Boot and Quarkus reproducer for CVE-2026-91858, an XXE in Apache Camel camel-fop via a third-party TransformerFactory, with affected…
0xblackash/cve-2026-109618Technical advisory on the PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619) covering root cause, exploitation vectors, detection checks, and PHP…
