halo-cve-2026-67919
k0nnect/halo-cve-2026-67919halo cms plugin 1-request rce from a url, PoC + exploit chain
exploitationweb-application-exploitationweb-security+3
1
Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
k0nnect/halo-cve-2026-67919halo cms plugin 1-request rce from a url, PoC + exploit chain
lanicer/cve-2026-41940-pocExploits cPanel/WHM CVE-2026-41940 authentication bypass via CRLF session injection for unauthenticated root-level WHM access, then lists accounts,…
andreamammano89-maker/cve-2021-42013_821311Exploits Apache HTTP Server CVE-2021-42013 for path traversal and CGI-based remote code execution during penetration testing.
ubaydev/cve-2026-15748Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
zavisco/cve-2026-64849.yamlDetects unauthenticated MLflow webhook SSRF (CVE-2026-64849) that accesses internal or cloud metadata services and leaks response details via…
graysignal/apache-ofbiz-auth-bypass-and-rce-exploit-cve-2023-49070-cve-2023-51467This exploit scans whether the provided target is vulnerable to CVE-2023-49070/CVE-2023-51467 and also exploits it depending on the choice of the…
biutrap/cve-2026-64849Proof-of-concept exploit for CVE-2026-64849: triggers SSRF in MLflow webhook API via crafted POST, fetching cloud instance metadata from…
deadexpl0it/cve-2026-19598-pocProof of Concept for CVE-2026-19598 affecting Pods <= 3.3.9.
superman-l/cve-2026-16723Reproduces fastjson 1.2.83 @JSONType RCE with a vulnerable Spring Boot target and ASM-based payload generator using HTTP or file protocol jar chains.
trandonga3/poc-cve-2026-63030-cve-2026-60137-Exploit chain for WordPress Core using REST API route-confusion and SQL injection for unauthenticated RCE, privilege escalation, and full server…
mattiacervelli/cve-2025-24893_analysisSelf-contained Docker lab that reproduces CVE-2025-24893, an unauthenticated SSTI-to-RCE in XWiki SolrSearch, and compares vulnerable vs patched…
anirbala98/cve-2026-539594gaBoards < 3.3.9 - User Information Disclosure
rosemary1337/cve-2025-24799Exploits GLPI CVE-2025-24799 via unauthenticated time-based blind SQL injection to extract usernames and password hashes from glpi_users for…
bebarossi/grav-cve-2024-28116Analysis and Docker reproduction of CVE-2024-28116 - SSTI with sandbox bypass in Grav CMS
rosemary1337/cve-2025-6934Automated PoC exploit for WordPress Opal Estate Pro that detects vulnerable versions, retrieves nonce, and creates unauthorized administrator…
bsdrip/cve-2026-40179-pocMinimal Python PoC for CVE-2026-40179: injects a malicious metric name via unauthenticated Prometheus remote_write to trigger stored XSS in the web…
renzi25031469/cve-2026-19478Detects CVE-2026-19478 in GitLab CE/EE with a non-destructive Nuclei template that triggers the GraphQL fallback-field method invocation via touch…
kaleth4/cve-2026-64638Technical analysis and defensive mitigation for a WordPress Core pre-auth XSS-to-RCE chain, including sanitizer bypass, DOM clobbering, JSONP abuse,…