adityabhatt3010/cve-2025-54794-hijacking-claude-ai-with-a-prompt-injection-the-jailbreak-that-talked-backA high-severity prompt injection flaw in Claude AI proves that even the smartest language models can be turned into weapons — all with a few lines of…
masasron/copyescape-cve-2026-17106PoC repository for the blog post CopyEscape: Taking Over Docker Hosts with docker cp
hackspeak/cve-2026-64638XSS2Shell (CVE-2026-64638) WordPress pre-auth XSS to RCE PoC mirror — WordSec, MIT; for authorized security testing
george0papasotiriou/cve-2026-21010-voip-sip-digest-authentication-replayPython PoC for CVE-2026-21010 that replays captured SIP digest Authorization headers to bypass nonce uniqueness/expiration and make unauthorized VoIP…
jackfromeast/cve-2025-30374Exploit PoCs for CVE-2025-30374, a Taipy class pollution bug, demonstrating RCE, reflected XSS, DoS, and OpenAI credential leakage with Docker-based…
george0papasotiriou/cve-2026-5556-kubernetes-admission-controller-bypass-via-case-sensitivityExploit PoC and vulnerable admission webhook for CVE-2026-5556, demonstrating Kubernetes admission controller bypass via case-sensitive pod name…
george0papasotiriou/cve-2026-7070-rdp-clipboard-hijacking-via-virtual-channel-injectionCVE-2026-7070 PoC for RDP clipboard hijacking via virtual channel injection; includes simulated server and exploit script for data theft/credential…
george0papasotiriou/cve-2026-21003-jwt-none-algorithm-bypass-via-kid-header-omissionProof-of-concept exploit for CVE-2026-21003 demonstrating JWT authentication bypass by omitting the kid header and using the 'none' algorithm to…
defineid/skeletonkeyCVE-2026-6765, Test only FormAutofill handlers exposed in Firefox
george0papasotiriou/cve-2026-22003-redis-lua-sandbox-escape-via-debug.sethook-Proof-of-concept exploit for CVE-2026-22003 demonstrating Redis Lua sandbox escape via debug.sethook to execute arbitrary system commands.
camillegr/cve-2026-73292Proof-of-concept exploit for CVE-2026-73292: CSRF attack on Semaphore UI password change endpoint, serving a malicious page that silently resets an…
george0papasotiriou/cve-2026-22016-ipfs-cid-spoofing-via-multihash-length-extensionPython proof-of-concept demonstrating IPFS CID spoofing via multihash length extension, highlighting content-addressing verification flaws that can…
george0papasotiriou/cve-2026-6060-quic-handshake-amplification-via-address-validation-bypassEducational Python PoC for a QUIC address-validation bypass that triggers handshake amplification, including vulnerable server simulation and attack…
george0papasotiriou/cve-2026-0101-ble-address-spoofing-via-weak-resolvable-private-addressPython PoC for CVE-2026-0101 demonstrating BLE address spoofing via replay of a captured Resolvable Private Address to impersonate a trusted…
george0papasotiriou/cve-2026-21016-malicious-pypi-package-install-hook-setup.py-execution-Demonstrates how a malicious Python package executes arbitrary commands during pip install via setup.py, highlighting PyPI supply chain and…
george0papasotiriou/cve-2026-22020-weak-seed-in-quantum-key-distribution-error-correctionPython PoC demonstrating CVE-2026-22020: exploitable weak seed in quantum key distribution privacy amplification, reducing final key entropy.
mthamil107/db_audit_researchSelf-Defeating Audits: reproducible lab showing a low-privilege PostgreSQL role reversibly blinding a trigger-based auditor + poisoning attribution…
sonnelon/cve-2026-23744-pocThe poc of CVE-2026-23744
