#1Tools for weaponizing vulnerabilities to gain unauthorized access to systems or data.
Kitploit recommended
oscerd/cve-2026-85247Runnable Spring Boot and Quarkus reproducer for CVE-2026-85247, demonstrating camel-knative TLS trust-all fallback and verifying the fix.
oscerd/cve-2026-85249Runnable Spring Boot and Quarkus reproducer for CVE-2026-85249, demonstrating camel-tika metadata header injection into CamelFileName with affected…
oscerd/cve-2026-85250Runnable XXE proof-of-concept for CVE-2026-85250 in Apache Camel camel-xpath (documentType=InputSource), with Spring Boot and Quarkus affected vs…
silentisvox/syscallrevenantClean Indirect Syscalls with Syscall Tampering.
nt2dev/cve-2026-36213-pocCVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation
nt2dev/cve-2026-55781-pocUnbounded memory allocation in NanaZip's UFS handler via an attacker-controlled `fs_bsize` field.
cplusplus17/deco-filepush-disclosureDisclosure and PoC for a root file read/write flaw in the TP-Link Deco XE75 Pro V3 debug channel (tmpsvr opcodes 0xC456/0xF0), with CVSS analysis and…
ife-ella/cve-vulnerabilityRepository referencing CVE-2026-0322; no README, documentation, or code details are available to describe its contents or purpose.
hexbytee/freepbx-sqli-rcePython proof-of-concept exploiting CVE-2025-57819, an unauthenticated SQL injection in FreePBX that chains admin creation, cron webshell deployment,…
abraxas/openmeetings-calendar-save-idorApache OpenMeetings 9.1.0 - High - Remote - IDOR - LOGIN calendar save overwrites appointment and closes public room
k4m1diamond/flowise-rceProof-of-concept exploit code for CVE-2025-58434 and CVE-2025-59528, demonstrating remote code execution in Flowise.
c8dhjp4tyv-bit/jbl-wave-buds2-firmware-researchReverse-engineering notes and Python tooling for JBL Wave Buds 2 (BES1306) firmware: OTA container format, flash layout, BLE/GATT protocol, and…
abraxas/jellyfin-ffmpeg-colonslashJellyfin Server 12.2 - High - Remote after .strm plant - FFmpeg arg injection - EncodingUtils -i leftover of GHSA-wwwm
oscerd/cve-2026-80312Runnable proof-of-concept for CVE-2026-80312, a fail-open OAuth guard in Apache Camel camel-oauth, with affected and fixed Spring Boot and Quarkus…
oscerd/cve-2026-80343Runnable proof-of-concept for CVE-2026-80343, a camel-netty-http security-constraint case-sensitivity bypass, with Spring Boot and Quarkus…
abraxas/jellyfin-svg-gzipJellyfin Server 12.2 - High - Remote - SSRF - gzip data:image/png leftover of GHSA-cf3c still fetches http and file
abraxas/plausible-editor-invitePlausible Analytics master d44e104 - High - Remote - Privilege leftover - editor people HTML leaks transfer nanoid
abraxas/plausible-traffic-notifyPlausible Analytics master d44e104 - High - Remote - IDOR - PUT traffic-change-notification site_id mass assignment
