#1Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
Kitploit recommended
horkimhab/cve-2026-109618-619Proof-of-concept code for CVE-2026-109618 and CVE-2026-109619 (php2shell bypass), packaged for authorized lab reproduction and vulnerability research.
yehia-mamdouh/xssya-v-2.0Python XSS scanner that confirms reflected and encoded-payload injection, executes payloads to capture cookies, detects WAFs, and tests XST with a…
eness/php2shell-cve-2026-109618-cve-2026-109619-pocProof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments.…
david-alvarez-rosa/php-rceExploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
9bie/php2shell-bypass-aslr-expPure-HTTP exploit achieving RCE on PHP 8.4.26 + Apache mod_php via session upload_progress heap leak, dangling pointer reuse, and ASLR bypass to call…
oscerd/cve-2026-85317Runnable Spring Boot proof-of-concept reproducing CVE-2026-85317, where camel-http's OAuth2 token cache ignores scope, resource and token endpoint,…
oscerd/cve-2026-88900Runnable Spring Boot proof-of-concept reproducing CVE-2026-88900, the camel-jgroups unsafe Java deserialization flaw, showing affected versus patched…
oscerd/cve-2026-88901Runnable Spring Boot proof-of-concept reproducing CVE-2026-88901, an XXE (CWE-611) flaw in Apache Camel camel-smooks, with affected and patched…
dinosn/php-cve-2026-10961x-lab-pocPHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full…
4rdr/proofsCollection of CVE findings, proof-of-concept references, and vulnerability research notes, including ExploitDB entries and credited security…
edoardottt/openhands-disclosureMultiple Command Injection vulnerabilities in openhands <0.62.0 allow an attacker to run arbitrary system commands.
oscerd/cve-2026-91858Runnable Spring Boot and Quarkus reproducer for CVE-2026-91858, an XXE in Apache Camel camel-fop via a third-party TransformerFactory, with affected…
ghxstsec/php2shell-pocPython exploit for CVE-2026-109618: abuses PHP session.upload_progress heap corruption to overwrite zend_call_function and achieve remote command…
orevim/cve-2026-18963-pocProof of concept and vulnerability checker for CVE-2026-18963, an unauthenticated account takeover in the Keycloak reset-credentials flow.…
david-alvarez-rosa/php-rceExploits for CVE-2026-109618 / CVE-2026-109619 to achieve RCE on PHP targets
laremontada12/cve-2026-39987-marimo-preauth-rceReproduction and root cause analysis of CVE-2026-39987 Marimo pre-auth WebSocket RCE in a local Docker lab.
ikow/php2shell-pocCVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
xuehuolll/cve-2026-109618-109619-auditCVE-2026-109618 / CVE-2026-109619 audit: session poisoning to command execution reproduced; BGCTX OOM precondition reproduced; claimed progress-array…
