CVE-2023-38408
wxrdnx/cve-2023-38408Slide deck and source code analyzing CVE-2023-38408, detailing the exploit methodology and attack vectors for educational security research.
ctfeducationexploitation+2
wxrdnx/cve-2023-38408Slide deck and source code analyzing CVE-2023-38408, detailing the exploit methodology and attack vectors for educational security research.
fazaroot/cve-2025-2539---file-away-wordpress-plugin-arbitrary-file-readAuthenticated arbitrary file read exploit for the File Away WordPress plugin (CVE-2025-2539). Includes PoC, attack flow, detection signatures, and…
infobyte/cve-2022-27255Automated firmware analysis and exploit toolkit for CVE-2022-27255, a Realtek eCos SDK SIP ALG buffer overflow affecting 30+ router models. Includes…
ahmedf000/cve-2025-49132_htb_season10Unauthenticated RCE exploit for CVE-2025-49132 in Pterodactyl Panel via path traversal, PEAR command injection, and PHP code execution. Includes HTB…
p1rat3r00t/why-so-serious-samPoC malware that uses exploit CVE-2021-36934 (improper ACLs on shadow copies) using a fileless red team method on Windows 10/11 with LOLBins,…
giardinas-dev/audit-xss-cve-2020-7934Docker-based XSS exploit for CVE-2020-7934 targeting Liferay portal. Demonstrates stored cross-site scripting via user profile fields to steal admin…
semperis/entragoatA deliberately vulnerable Microsoft Entra ID environment. Learn identity security through hands-on, realistic attack challenges.
mvelazc0/badzureBadZure automates the deployment of intentionally misconfigured Entra ID tenants and Azure subscriptions, populating them with diverse entities and…
momenbasel/htb-writeupsStructured collection of 500+ Hack The Box machine writeups, 400+ challenge solutions, and interactive learning tools including knowledge graphs,…
fallen-angel-systems/fas-judgement-ossOpen-source prompt injection attack console. Test AI security by firing categorized attacks at any endpoint.
ayham-megdadi/zero-day-legacyA vulnerable Boot-to-Root CTF lab machine simulating a hospital environment. Features a realistic 17-step attack chain including SQL Injection, XSS,…
demining/digital-signature-forgery-attackHow CVE-2025-29774 Vulnerabilities and the SIGHASH_SINGLE Bug Threaten Multi-Signature Wallet Operational Methods with Fake RawTX
het-kalariya/cve-2026-20253Self-contained security training lab reproducing CVE-2026-20253 (Splunk Enterprise unauthenticated RCE). Provides a Docker-based environment to…
pannagkumaar/pentest-labModern cyber range with 50 hands-on challenges across web, API, cloud, AI, and blue-team security tracks. Features guided attack chains, transparent…
daniyal48/ghostlock-vagrant-boxAn isolated Vagrant testbed designed to simulate a complete attack chain: Initial access via the Nginx heap buffer overflow (CVE-2026-42533) followed…
maxime288/cve-2026-8838-rceEducational PoC for CVE-2026-8838, a critical RCE vulnerability in Amazon Redshift Python Driver via unsafe eval() in vector_in(). Includes technical…
aalex954/jwt-key-confusion-pocJWT Key Confusion PoC (CVE-2015-9235) Written for the Hack the Box challenge - Under Construction