#1Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
Kitploit recommended
ikow/php2shell-pocCVE-2026-109618/109619 PHP session.upload_progress Exploit Research — POC & Analysis
xuehuolll/cve-2026-109618-109619-auditCVE-2026-109618 / CVE-2026-109619 audit: session poisoning to command execution reproduced; BGCTX OOM precondition reproduced; claimed progress-array…
lsudoko/antibodyGitLab Duo DevSecOps loop where a second AI re-attacks every AI-written fix, saving each successful bypass as a permanent antibody replayed in CI and…
oscerd/cve-2026-85254Runnable Spring Boot and Quarkus reproducer for CVE-2026-85254, demonstrating Apache Camel camel-platform-http header-echo suppression bypass via…
oscerd/cve-2026-85296Runnable Spring Boot and Quarkus proof-of-concept reproducing CVE-2026-85296, a camel-as2 cross-partner MDN signing key confusion (CWE-488), with…
oscerd/cve-2026-85301Runnable proof-of-concept reproducer for the Apache Camel camel-keycloak issuer validation bypass (CWE-287), demonstrating affected and patched…
oscerd/cve-2026-85312Runnable proof-of-concept reproducer for CVE-2026-85312, demonstrating Apache Camel saga hijacking via the Long-Running-Action header in Spring Boot…
oscerd/cve-2026-85313Runnable Spring Boot proof-of-concept reproducing CVE-2026-85313, where Apache Camel camel-jetty enableCORS reflects any origin with credentials,…
oscerd/cve-2026-85314Runnable proof-of-concept reproducer for CVE-2026-85314, demonstrating camel-mail MimeMultipart mail.smtp header injection in Camel Spring Boot and…
abraxas/superset-g3-v0-import-sql-plantProof-of-concept lab for an Apache Superset 6.1.0 authorization flaw where a Gamma dashboard editor plants dataset SQL via unversioned v0 dashboard…
horizon3ai/cve-2026-106173Python proof-of-concept exploit for CVE-2026-106173, an unauthenticated gRPC path traversal file write in Fortinet FortiSIEM that enables blind…
boredhackerblog/plex2shell_pcapPacket capture artifacts of plex2shell exploitation against Plex, including lab and in-the-wild traffic, for building and validating detection…
code-zm/plex2shellCVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656
oscerd/cve-2026-80344Runnable proof-of-concept reproducer for CVE-2026-80344 in Apache Camel camel-as2, demonstrating asynchronous MDN SSRF and credential disclosure with…
oscerd/cve-2026-83531Runnable Spring Boot proof-of-concept for CVE-2026-83531, demonstrating expression-language injection in Apache Camel's dynamic-router-control…
oscerd/cve-2026-84178Runnable proof-of-concept reproducer for CVE-2026-84178, a login CSRF in Apache Camel camel-oauth's authorization-code callback that redeems codes…
oscerd/cve-2026-84181Runnable Spring Boot and Quarkus proof-of-concept reproducing the Apache Camel camel-shiro thread-bound-subject authentication bypass, with affected…
oscerd/cve-2026-85243Runnable Spring Boot and Quarkus proof-of-concept for CVE-2026-85243, demonstrating the Apache Camel camel-crypto-pgp integrity-verification…
