Tools for identifying, assessing, and prioritizing security weaknesses in systems and applications.
minanagehsalalma/zyxel-social-login-bypass-cve-2026-8508Public writeup, PoC, and emulation materials for CVE-2026-8508 affecting Zyxel captive-portal social login.
opaxial/cve-2026-9830Python PoC validating unauthenticated BookingPress Pro REST API exposure and checking for exposed booking/customer data with configurable request…
boreas37/cve-2026-73678-pocCVE-2026-73678 — MindsDB Minds Platform unauthenticated RCE via scratchpad exec (CVSS 10.0). Verified end-to-end with real LLM
r2qa/cve-2026-17544Exploit for CVE-2026-17544: PHP bcmath OOB write converted into memory-only RCE, bypassing disable_functions and open_basedir with a runtime…
cuteecat/cve-2026-73633Proof-of-concept exploit for Apache Struts S2-072 (CVE-2026-73633), demonstrating CPU and memory exhaustion by sending crafted JSON requests to the…
franc-zar/cve-2026-72898-safe-detectionSimple script to achieve safe and non-desruptive active detection of CVE-2026-72898 (SQLi in Metabase)
alixploit22/cve-2025-11740Python proof-of-concept for CVE-2025-11740; triggers the vulnerability to verify exposure and support remediation in authorized security tests.
saiteja-erukude/cve-2026-47103-python-statemachine-rcePython StateMachine 3.0.0 < 3.2.0 RCE via unsafe SCXML <data expr> evaluation and Python eval() injection.
saiteja-erukude/cve-2026-47117-openmed-rceOpenMed < 1.5.2 unauthenticated RCE via PII privacy-filter model loading and trust_remote_code=True
saiteja-erukude/cve-2026-9147-uproot-rceuproot <= 5.7.4 code injection via unsafe Python source generation from ROOT TStreamerInfo metadata.
sanaullahamanullah/xss2shell-checkNon-destructive detector for CVE-2026-64638 (XSS2Shell) — WordPress pre-auth XSS reflection primitive
blacksheepstudio/cve-2017-7921-expPython exploit for CVE-2017-7921 in Hikvision IP cameras, performing unauthenticated user enumeration, snapshot capture, and configuration file…
eh-amish/windows-defender-security-auditor-cve-2026-50656-Read-only PowerShell security auditor for Windows endpoints and servers: checks Defender configuration, patch status, credentials, persistence,…
daemoncibsec/flar3adPOC of CVE-2026-51031 for arbitrary local file read
hav0cx0/cve-2023-48795Scans SSH servers for Terrapin-affected OpenSSH versions by grabbing banners over port 22, enabling quick internal audits, penetration testing, and…
iamrajkumar1995/cve-2025-5781_freepbxProof-of-concept exploit for FreePBX Endpoint module CVE-2025-5781: chains unauthenticated SQL injection with database manipulation and scheduled…
kentox493/cve-2026-42945_nginxriftAutomates CVE-2026-42945 exploitation in NGINX containers: verifies vulnerable targets, brute-forces heap offsets, executes commands, and opens an…
686f6c61/poc-geoleak-cve-2026-52715PoC funcional de CVE-2026-52715 (GeoLeak): SQLi no autenticada en GEO my WordPress <= 4.5.5 via swlatlng/nelatlng. Laboratorio Docker + exploit…
