#1Tools for weaponizing vulnerabilities to gain unauthorized access to systems or data.
Kitploit recommended
oscerd/cve-2026-85317Runnable Spring Boot proof-of-concept reproducing CVE-2026-85317, where camel-http's OAuth2 token cache ignores scope, resource and token endpoint,…
oscerd/cve-2026-88900Runnable Spring Boot proof-of-concept reproducing CVE-2026-88900, the camel-jgroups unsafe Java deserialization flaw, showing affected versus patched…
oscerd/cve-2026-88901Runnable Spring Boot proof-of-concept reproducing CVE-2026-88901, an XXE (CWE-611) flaw in Apache Camel camel-smooks, with affected and patched…
dinosn/php-cve-2026-10961x-lab-pocPHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full…
4rdr/proofsCollection of CVE findings, proof-of-concept references, and vulnerability research notes, including ExploitDB entries and credited security…
oscerd/cve-2026-91858Runnable Spring Boot and Quarkus reproducer for CVE-2026-91858, an XXE in Apache Camel camel-fop via a third-party TransformerFactory, with affected…
0xblackash/cve-2026-109618Technical advisory on the PHP2Shell RCE flaws (CVE-2026-109618, CVE-2026-109619) covering root cause, exploitation vectors, detection checks, and PHP…
ghxstsec/php2shell-pocPython exploit for CVE-2026-109618: abuses PHP session.upload_progress heap corruption to overwrite zend_call_function and achieve remote command…
orevim/cve-2026-18963-pocProof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow.…
david-alvarez-rosa/php-rceExploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
prepouce/coercedpotatoWindows local privilege escalation tool that abuses SeImpersonatePrivilege via MS-RPRN and MS-EFSR RPC coercion to execute commands as SYSTEM.
ikow/php2shell-pocCVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
xuehuolll/cve-2026-109618-109619-auditCVE-2026-109618/109619 — PHP session.upload_progress pre-auth RCE. Exploit research: remote ASLR chain, PoC & patch analysis.
trhhubsd/artexMulti-agent LLM system for autonomous penetration testing in isolated labs: planner/worker agents share asset and exploration graphs, with MITM…
oscerd/cve-2026-85254Runnable Spring Boot and Quarkus reproducer for CVE-2026-85254, demonstrating Apache Camel camel-platform-http header-echo suppression bypass via…
oscerd/cve-2026-85296Runnable Spring Boot and Quarkus proof-of-concept reproducing CVE-2026-85296, a camel-as2 cross-partner MDN signing key confusion (CWE-488), with…
oscerd/cve-2026-85300Runnable Spring Boot and Quarkus reproducer for CVE-2026-85300, demonstrating camel-pqc writing private keys with permissive umask-derived file…
oscerd/cve-2026-85301Runnable proof-of-concept reproducer for the Apache Camel camel-keycloak issuer validation bypass (CWE-287), demonstrating affected and patched…
