Tools

george0papasotiriou/cve-2026-11111-toctou-in-file-permission-check-before-open

Educational CVE PoC for a TOCTOU file-permission race in Flask; uses symlink replacement during the check-open window to disclose sensitive files.

nxploited/cve-2024-7135

Proof-of-concept exploit for authenticated arbitrary file read via directory traversal in WordPress Tainacan plugin (CVE-2024-7135).

ajinabraham/xenotix-python-keylogger

Xenotix Python Keylogger for Windows.

jfriedli/cve-2025-11973

Proof-of-concept exploit for CVE-2025-11973 demonstrating local file inclusion (LFI) in WordPress via file:// protocol, with automated exfiltration…

octoberfest7/zip_smuggling

Python3 utility for creating zip files that smuggle additional data for later extraction

cerberusmrxi/langflow-cve-2026-33017-exploit

CVE-2026-33017 exploitation tool for Langflow <1.9.0. Features reverse shells, command execution, file operations, persistence, and automated…

ifpdz/cve-2025-24104

Technical writeup of CVE-2025-24104: an iOS sandbox escape via symlink validation bypass in backup restoration, enabling arbitrary file reads outside…

0xterror/cve-2023-22047-oracle-peoplesoft-lfi

CVE-2023-22047 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit…

jfriedli/cve-2025-12137

Proof-of-concept exploit for CVE-2025-12137 demonstrating local file disclosure via a WordPress plugin's REST API importer endpoint. Includes…

smarttfoxx/cve-2025-65321

Language Sloth Sloth Bot 1.0 is vulnerable to Directory Traversal in the gif() and png() functions. The functions build file paths using unsanitized…

s3n4t0r-0x0/pixelcode-attack

Malicious PixelCode is a security research project that demonstrates a covert technique for encoding executable files into pixel data and storing…

deathshotxd/cve-2025-52691-apt-poc

An enhanced proof-of-concept exploit for CVE-2025-52691 (SmarterMail Arbitrary File Upload RCE) with APT-level features like stealth obfuscation,…

absholi7ly/apache-ofbiz-directory-traversal-exploit

Exploit for Apache OFBiz CVE-2024-32113 path traversal via crafted XML-RPC requests, enabling arbitrary file read and potential command execution on…

toanln-cov/cve-2026-66493

The Joomla extension PhocaCommander is vulnerable to Path Traversal in delete, copy, move actions - CVSS 6.4

bee-san/pywhat

🐸 Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it…

mbadanoiu/cve-2024-34693

CVE-2024-34693: Server Arbitrary File Read in Apache Superset

jricramc/aigate

AI Prompt Secret Scanner: local proxy and Claude Code hook that blocks secrets before they reach AI APIs