CVE-2026-71518
ilhomjonr/cve-2026-71518Advisory and PoC for an unauthenticated authorization bypass in Typemill media downloads, using path-equivalent URL variants to access…
authentication-authorizationvulnerability-analysisexploitation+3
1
Penetration testing methodologies, frameworks, reporting, and automation tools.
ilhomjonr/cve-2026-71518Advisory and PoC for an unauthenticated authorization bypass in Typemill media downloads, using path-equivalent URL variants to access…
davkharrr/cve-2026-19478-pocProof-of-concept exploit for unauthenticated remote code injection in GitLab's GraphQL API, using crafted queries to modify or delete public projects…
securifera/cve-2026-20217Reproduces ZendTo unauthenticated ClamAV RCE and root privilege escalation in an authorized lab, with pinned Docker target, fail-closed verification,…
typedefabcd1234ntd/cve-2026-19501-pocProof-of-concept for unauthenticated CSV formula injection in SureForms, showing crafted form submissions trigger spreadsheet formulas when exported…
boreas37/cve-2025-62593-pocPoC for CVE-2025-62593: unauthenticated RCE in Ray (CISA KEV). Stdlib-only Python.
cypherhippie/cve-2026-34486---unauthenticated-rce-via-java-deserializationEncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.
cypherhippie/cve-2026-66804Local Windows privilege escalation PoC for CVE-2026-66804: plants a COM DLL in a missing path to abuse Camera FrameServer and impersonate SYSTEM.
graysignal/cve-2024-20767-adobe-coldfusionPoC exploit for CVE-2024-20767 in Adobe ColdFusion, leveraging an improper access control flaw to read arbitrary files from affected servers.
graysignal/cve-2024-23897-jenkins-arbitrary-read-file-vulnerabilityUnauthenticated Jenkins CLI exploit scanner for CVE-2024-23897 that detects vulnerable versions and reads arbitrary files from the controller through…
graysignal/cve-2024-24919-check-point-remote-access-vpnScan for and exploit CVE-2024-24919 in Check Point Security Gateways, an unauthenticated arbitrary file read that can expose credentials and lead to…
graysignal/cve-2024-28995-solarwinds-serv-uExploit for CVE-2024-28995 affecting SolarWinds Serv-U 15.4.2 HF 1 and previous versions
graysignal/cve-2024-4040-crushftp-serverExploit for CVE-2024-4040 affecting CrushFTP server in all versions before 10.7.1 and 11.1.0 on all platforms
graysignal/cve-2024-4879-servicenowExploit for CVE-2024-4879 affecting Vancouver, Washington DC Now and Utah Platform releases
graysignal/cve-2024-4956-sonatype-nexus-repository-managerExploit for CVE-2024-4956 affecting all previous Sonatype Nexus Repository 3.x OSS/Pro versions up to and including 3.68.0
graysignal/cve-2024-50803-redaxoProof-of-concept for stored cross-site scripting in Redaxo's mediapool (CVE-2024-50803), demonstrating malicious SVG upload on versions below 5.18.0…
graysignal/cve-2025-3248Exploit scanner detecting unauthenticated code injection in Langflow's /api/v1/validate/code endpoint and executing arbitrary code for authorized…
horkimhab/cve-2026-18504-cve-2026-16732Educational repository for documenting and testing CVE proof-of-concept exploits inside isolated labs, virtual machines, and authorized penetration…
yora1928/cve-2026-15748Scans WordPress Forminator for CVE-2026-15748 unauthenticated RCE. Detects vulnerable sites, crawls forms, extracts nonces, runs safe upload tests.