Tools for testing, exploiting, and securing web applications and APIs.
0xterror/cve-2023-22047---oracle-peoplesoft-lfiCVE-2023-22047 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit…
4minx/cve-2026-72898Proof-of-concept exploit for CVE-2026-72898, an unauthenticated SQL injection in Metabase's password-reset endpoint. Forges an admin session for full…
0xterror/cve-2023-22047-oracle-peoplesoft-lfiCVE-2023-22047 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit…
alixploit22/cve-2026-6440mencari sebuah kerentanan, wodpres dan mengungah shell di kerentanan wodpres tersebut
alixploit22/cvex2shelExploit for CVE-2026-64638, a pre-authentication reflected XSS in WordPress login, enabling injection of malicious JavaScript into /wp-login.php…
h4zaz/cve-2026-8793Technical CVE write-up detailing missing brute-force protection in a web admin login form, with PoC reproduction, attack-chain context, and…
h4zaz/cve-2026-8794Username Enumeration via Authentication Timing Side-Channel in PaperCut NG
hunt-benito/bring-your-own-key-cve-2026-73678-unauthenticated-rce-in-mindsdb-coworkPoC exploit for CVE-2026-73678: unauthenticated RCE in MindsDB Cowork via attacker-supplied LLM key and unsandboxed scratchpad exec to run OS…
kimdir01/cve-2026-9090-pocPoC for CVE-2026-9090 — Casdoor SAML signature bypass (CWE-347). Reproduction-only; coordinated via CERT/CC VU#780781.
sanr01/cve-2021-41773-exploit-labReproduces CVE-2021-41773 path traversal in Apache HTTP Server 2.4.49, with PoC code, root-cause analysis, impact assessment, and mitigation guidance…
balochkainat160-cyber/cs50-cybersecurityCS50's Introduction to Cybersecurity final project on React2Shell (CVE-2025-55182)
dinosn/cve-2026-71362-magento-labDocker lab reproducing CVE-2026-71362 Magento/Adobe Commerce account takeover via customer-session identity switch, with PoC and official-patch A/B/A…
ghostpels/cve-2026-13610Exploit PoC for unauthenticated doctor/receptionist account creation in the KiviCare WordPress plugin via improper privilege management, providing…
isukasanuj/cve-2025-70559Python exploit for CVE-2025-70559 targeting an upload directory bypass/remote code execution; run with LHOST and LPORT to establish a reverse shell.
oguzylmzx/cve-2025-64512-pdfminer-pocPoC for CVE-2025-64512: pdfminer.six CMapDB pickle deserialization RCE via crafted PDF
ubitquity/metabase-setup-endpoint-sqli-fixFixes unauthenticated SQL injection in a setup endpoint by replacing raw JDBC queries with ORM parameterization and constant-time token validation.
watchtowrlabs/watchtowr-vs-citrix-netscaler-preauth-rce-cve-2026-8452Proof-of-concept exploit for Citrix NetScaler CVE-2026-8452 that verifies pre-auth RCE by building shellcode and executing commands through a…
e4zyy/livewire2025cveFast Python scanner detects vulnerable Laravel Livewire v3 sites (CVE-2025-54068, CVSS 9.2). Separates risky sites into vuln.txt, safe sites into…
