Payload Generation

bardlaudian/cve-2025-64512

CLI wrapper for CVE-2025-64512 PoC generating malicious PDF and pickle.gz payloads to exploit insecure deserialization in pdfminer.six, enabling…

shinthink/cve-2026-3891

Pix for WooCommerce Unauthenticated File Upload via certificate_crt_path Parameter | CVSS 9.8

shinspace92/cve-2024-26229

Nim touch up of CVE 2024 26229

iqbalx7/wp2shell

unauthenticated RCE in WordPress core (CVE-2026-63030 + CVE-2026-60137)

hidden-investigations/wp2shell-scanner

WordPress wp2shell vulnerability-chain scanner for CVE-2026-63030 and CVE-2026-60137, with active detection, optional PoC, JSON export.

resolvdd/cve-2026-38526-poc-htb-nexus

A PoC script for CVE-2026-38526, RCE via a file upload vulnerability in the /admin/tinymce/upload endpoint of webkul krayin 2.2.x

matesz44/cve-2025-64512

CVE-2025-64512: pdfminer.six pickle deserialization rce; .pickle.gz + pdf generator w/ custom payloads

chiefyoru/cve-2026-56290_poc

The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to…

ekomssavior/wp2shell

CVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)

chiefyoru/cve-2026-56291_poc

The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full…

chiefyoru/cve-2026-63030_poc

CVE-2026-63030 - WordPress Core Pre-Auth RCE Mass Exploit

securelayer7/wordpresshell

Pre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)

mverschu/cve-2026-63030

PoC Exploit of WordPress Core Unauthenticated RCE known as WP2Shell

ungabunga-ctf/cve-2023-26039

CVE-2023-26039 - ZoneMinder. Any authenticated user can construct an api command to execute any shell command as the web user.

industri4l-h3ll-xpl0it3rs/cve-2026-38526-krayincrm-rce

CVE-2026-38526 Exploit | by infrar3d