#1Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).
Kitploit recommended
edoardottt/pphackAdvanced Client-Side Prototype Pollution Scanner
watchtowrlabs/cve-2024-4577PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution PoC
proviesec/xss-payload-listCurated collection of cross-site scripting payloads, polyglots, and injection test rules for web application penetration testing and bug bounty…
hausec/proxylogonPython exploit for ProxyLogon (CVE-2021-26855) targeting Microsoft Exchange servers. Drops a webshell for remote command execution and…
ambionics/laravel-exploitsExploit for CVE-2021-3129
ridter/rtf_11882_0802PoC for CVE-2018-0802 And CVE-2017-11882
varbaek/xsserFrom XSS to RCE 2.75 - Black Hat Europe Arsenal 2017 + Extras
subgraph/vegaSubgraph Vega
emredavut/cve-2025-55182Chrome extension and Shodan scanner for detecting and demonstrating RCE vulnerabilities in React Server Components (RSC) and Next.js applications,…
hev0x/cve-2021-26084_confluencePython exploit for CVE-2021-26084, an OGNL injection vulnerability in Confluence Server/Data Center allowing authenticated or unauthenticated remote…
chocapikk/cve-2026-21858n8n Ni8mare - Unauthenticated Arbitrary File Read to RCE Chain (CVSS 10.0)
voulnet/cve-2017-8759-exploit-sampleRunning CVE-2017-8759 exploit sample.
osandamalith/lfifreakA unique automated LFi Exploiter with Bind/Reverse Shells
paradoxis/flask-unsignCommand line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys.
al1ex/cve-2021-22205CVE-2021-22205& GitLab CE/EE RCE
exodusintel/cve-2019-5786FileReader Exploit
bobtheshoplifter/spring4shell-pocSpring4Shell Proof Of Concept/And vulnerable application CVE-2022-22965
