#1Tools for weaponizing vulnerabilities to gain unauthorized access to systems or data.
Kitploit recommended
0xblackash/cve-2026-109618Technical advisory on the PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619) covering root cause, exploitation vectors, detection checks, and PHP…
ghxstsec/php2shell-pocPython exploit for CVE-2026-109618: abuses PHP session.upload_progress heap corruption to overwrite zend_call_function and achieve remote command…
orevim/cve-2026-18963-pocProof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow.…
david-alvarez-rosa/php-rceExploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
prepouce/coercedpotatoWindows local privilege escalation tool that abuses SeImpersonatePrivilege via MS-RPRN and MS-EFSR RPC coercion to execute commands as SYSTEM.
ikow/php2shell-pocCVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
xuehuolll/cve-2026-109618-109619-auditCVE-2026-109618 / CVE-2026-109619 audit: session poisoning to command execution reproduced; BGCTX OOM precondition reproduced; claimed progress-array…
trhhubsd/artexMulti-agent LLM system for autonomous penetration testing in isolated labs: planner/worker agents share asset and exploration graphs, with MITM…
oscerd/cve-2026-85254Runnable Spring Boot and Quarkus reproducer for CVE-2026-85254, demonstrating Apache Camel camel-platform-http header-echo suppression bypass via…
oscerd/cve-2026-85296Runnable Spring Boot and Quarkus proof-of-concept reproducing CVE-2026-85296, a camel-as2 cross-partner MDN signing key confusion (CWE-488), with…
oscerd/cve-2026-85300Runnable Spring Boot and Quarkus reproducer for CVE-2026-85300, demonstrating camel-pqc writing private keys with permissive umask-derived file…
oscerd/cve-2026-85301Runnable proof-of-concept reproducer for the Apache Camel camel-keycloak issuer validation bypass (CWE-287), demonstrating affected and patched…
oscerd/cve-2026-85312Runnable proof-of-concept reproducer for CVE-2026-85312, demonstrating Apache Camel saga hijacking via the Long-Running-Action header in Spring Boot…
oscerd/cve-2026-85313Runnable Spring Boot proof-of-concept reproducing CVE-2026-85313, where Apache Camel camel-jetty enableCORS reflects any origin with credentials,…
oscerd/cve-2026-85314Runnable proof-of-concept reproducer for CVE-2026-85314, demonstrating camel-mail MimeMultipart mail.smtp header injection in Camel Spring Boot and…
abraxas/superset-g3-v0-import-sql-plantProof-of-concept lab for an Apache Superset 6.1.0 authorization flaw where a Gamma dashboard editor plants dataset SQL via unversioned v0 dashboard…
horizon3ai/cve-2026-106173Python proof-of-concept exploit for CVE-2026-106173, an unauthenticated gRPC path traversal file write in Fortinet FortiSIEM that enables blind…
emad-almousa/cve-2025-53051Proof-of-concept code and technical write-up demonstrating CVE-2025-53051, an Oracle 26ai histogram dictionary vulnerability exploitable through a…
