Payload Generation

amao26/cve-2026-23744-poc

CVE-2026-23744 is an unauthenticated command injection in MCPJam Inspector ≤1.4.2 via /api/mcp/connect. This POC exploits it by sending a crafted…

g0d150ne/cve-2025-2945

Exploit for pgAdmin4 Remote Code Execution (RCE) vulnerability affecting versions 8.10 to 9.1.

malwaredllc/byob

An open-source post-exploitation framework for students, researchers and developers.

nikitapark/cve-2023-50164-poc

CVE-2023-50164 PoC Application & Exploit script

eh-amish/cve-2026-64638-xss-to-shell-poc

Validates pre-authentication reflected XSS in WordPress, fingerprints vulnerable versions, checks payload reflection and JSONP, and generates…

0xlipon/xss2shell

Behavior-first WordPress CVE-2026-64638 scanner using benign login probes; classifies sanitizer behavior and generates alert-only PoCs for authorized…

swisskyrepo/payloadsallthethings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

jiahong-guan/log4j-shell-poc

A Proof-Of-Concept for the CVE-2021-44228 vulnerability.

mohwahyudi/poc-cve-2026-64638-

PoC exploit chain for WordPress pre-auth XSS to RCE via DOM clobbering, REST JSONP/SOME, and plugin upload, with Docker lab verification and…

hackspeak/cve-2026-64638

Proof-of-concept exploiting WordPress pre-auth XSS to RCE via DOM clobbering, REST API abuse, and malicious plugin upload for server-side execution.…

imbas007/cve-2026-64638-poc

CVE-2026-64638: WordPress Pre-auth XSS → RCE (XSS2Shell) PoC

nullroot-red/cve-2026-23744

Proof-of-concept and offensive security research analyzing CVE-2026-23744 (MCPJam Inspector Unauthenticated RCE, Patched in v1.4.3+).

ezramansor/cve-2025-32432-poc

A simple PoC on the Remote Code Execution (RCE) Vulnerability of CraftCMS designated as CVE-2025-32432 written in Go

noraj/vbsmin

VBScript minifier

wordsec/xss2shell

Wordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)