CVE-2026-28134
randomrobbiebf/cve-2026-28134JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
vulnerability-analysisexploitationweb-application-exploitation+1
Tools for testing, exploiting, and securing web applications and APIs.
randomrobbiebf/cve-2026-28134JetEngine <= 3.7.2 - Authenticated (Contributor+) Remote Code Execution
randomrobbiebf/cve-2025-67923JetEngine <= 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API
randomrobbiebf/cve-2026-2413Ally – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path
k3ystr0k3r/cve-2026-39987Proof-of-concept exploit for Marimo pre-authentication RCE. Uses the unauthenticated /terminal/ws WebSocket endpoint to spawn a PTY and establish a…
wattocyber/offensive-one-liners110 offensive security one-liners for authorized testing and CTFs, organized in one markdown notebook by category and kill-chain step. Dual-use…
losfuzzys/glacierctf2023_writeupsCurated CTF writeup collection for GlacierCTF 2023 covering pwn, rev, web, crypto, and smart contract challenges with solutions and educational…
paradigmxyz/iron-proxyAn egress firewall for untrusted workloads.
k0nnect/halo-cve-2026-67919halo cms plugin 1-request rce from a url, PoC + exploit chain
lanicer/cve-2026-41940-pocExploits cPanel/WHM CVE-2026-41940 authentication bypass via CRLF session injection for unauthenticated root-level WHM access, then lists accounts,…
andreamammano89-maker/cve-2021-42013_821311Exploits Apache HTTP Server CVE-2021-42013 for path traversal and CGI-based remote code execution during penetration testing.
ubaydev/cve-2026-15748Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
zavisco/cve-2026-64849.yamlDetects unauthenticated MLflow webhook SSRF (CVE-2026-64849) that accesses internal or cloud metadata services and leaks response details via…
graysignal/apache-ofbiz-auth-bypass-and-rce-exploit-cve-2023-49070-cve-2023-51467This exploit scans whether the provided target is vulnerable to CVE-2023-49070/CVE-2023-51467 and also exploits it depending on the choice of the…
biutrap/cve-2026-64849Proof-of-concept exploit for CVE-2026-64849: triggers SSRF in MLflow webhook API via crafted POST, fetching cloud instance metadata from…
deadexpl0it/cve-2026-19598-pocProof of Concept for CVE-2026-19598 affecting Pods <= 3.3.9.
superman-l/cve-2026-16723Reproduces fastjson 1.2.83 @JSONType RCE with a vulnerable Spring Boot target and ASM-based payload generator using HTTP or file protocol jar chains.
trandonga3/poc-cve-2026-63030-cve-2026-60137-Exploit chain for WordPress Core using REST API route-confusion and SQL injection for unauthenticated RCE, privilege escalation, and full server…
mattiacervelli/cve-2025-24893_analysisSelf-contained Docker lab that reproduces CVE-2025-24893, an unauthenticated SSTI-to-RCE in XWiki SolrSearch, and compares vulnerable vs patched…