#1Custom payload crafting, obfuscation, AV evasion, and delivery mechanism tools.
Kitploit recommended

Malicious Register Directive Code Injection Exploit
GhostLock One-Tap Execution App (CVE-2026-43499)

Go-based proof-of-concept for CVE-2025-55182, a critical RCE in React Server Components. Features vulnerability checking, command execution, memory…

Hack The Box Writeup for Retired Challenge ReactOOPS - Complete solution and educational guide to CVE-2025-55182/CVE-2025-66478 (React2Shell RCE).…

CVE-2020-35729

OpenSSL heap overflow PoC (CVE-2014-0195)

Proof-of-concept for CVE-2023-32571, demonstrating remote code execution via Dynamic Linq injection in ASP.NET applications. Includes payloads and a…

PoC CVE-2025-49144

Pre-auth RCE in WordPress Core via REST API batch route confusion + WP_Query SQLi (CVE-2026-63030 / CVE-2026-60137). Detection PoC.

Microsoft Windows - 'srv2.sys' SMB Code Execution (Python) (MS09-050)

CVE-2021-4034 PoC , polkit < 0.131

Proof-of-concept exploit for CVE-2024-6387 targeting glibc address manipulation to achieve remote code execution.

CVE-2018-0834 full code exec

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

Proof-of-concept exploit for CVE-2024-6387 targeting vulnerable OpenSSH servers via heap manipulation and race condition to achieve remote code…

Research and PoC for CVE-2024-6386

PoC for CVE-2020-25042: automated Mara CMS 7.5 authenticated PHP upload to RCE, with login hash handling, shell reuse, custom payload support, and…

Glass Cage is a zero-click PNG-based RCE chain in iOS 18.2.1, exploiting WebKit (CVE-2025-24201) and Core Media (CVE-2025-24085) to achieve sandbox…