Tools

deepinstinct/shimme

PoC for Windows privilege escalation and code injection using OfficeClickToRun RPC and undocumented shim manipulation to inject DLLs into SYSTEM…

payatu/cve-2017-5638

Apache Struts 2.0 RCE vulnerability - Allows an attacker to inject OS commands into a web application through the content-type header

drapl0n/dirtypipe

DirtyPipe: Exploit for a new Linux vulnerability known as 'Dirty Pipe(CVE-2022-0847)' allows local users to gain root privileges. The vulnerability…

showy-headteacher114/cve-2025-66398

Demonstrate exploitation of Signal K Server CVE-2025-66398 allowing unauthenticated attackers to inject backdoor and enable remote code execution.

r00t7oo2jm/-cve-2024-21683-rce-in-confluence-data-center-and-server

This vulnerability allows an unauthenticated attacker to remotely execute arbitrary code on a vulnerable Confluence server. The vulnerability exists…

barisbaydur/cve-2025-44148

A reflected cross-site scripting (XSS) vulnerability exists in MailEnable Webmail due to improper user input sanitization in the failure.aspx. This…

xryptoh/cve-2025-63498

Stored XSS proof-of-concept for SOGo groupware, exploiting the 'Remember Username' cookie to inject JavaScript payloads via the login endpoint.

jlsakuya/cve-2022-0847-container-escape

A simple exploit that uses dirtypipe to inject shellcode into runC entrypoint to implement container escapes.

cerberusmrxi/flowise-cve-2026-58057-exploit

Flowise Windows RCE exploit for CVE-2026-58057. Bypasses environment variable validation via case-sensitive flaw. Uses node_options to inject…

sergeb250/blueducky

BlueDucky exploits a Bluetooth vulnerability, specifically CVE-2023-45866, which allows an attacker to inject keystrokes into a target device. The…

86x/cve-2021-45416

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the…

folks-iwd/cve-2026-2600-poc

Proof-of-concept exploit for CVE-2026-2600, a stored XSS in ElementsKit Elementor Addons <= 3.7.9, allowing authenticated Contributors to inject…

jimmexploit/cve-2026-42167-poc

Functional SQL injection exploit for CVE-2026-42167 in ProFTPD mod_sql, enabling unauthenticated attackers to inject commands via USER parameter.…

soy-oreocato/cve-2023-46998

Proof-of-concept exploit for a stored/reflected Cross-Site Scripting (XSS) vulnerability in Bootbox.js versions 3.2 through 6.0, allowing remote…

absholi7ly/jspdf-object-injection

CVE-2026-25755 A critical PDF Object Injection vulnerability in jsPDF allows attackers to inject arbitrary PDF objects through the addJS() function,…

thecybergeek/cve-2019-19369

Authenticated remote code execution exploit for FusionPBX versions <= 4.5.10, leveraging the PHP-Editor function to inject a payload and gain a shell…

ronf98/cve-2023-6000-poc

This vulnerability displays an XSS flaw in a WordPress popup plugin, allowing attackers to inject malicious JavaScript through a stored XSS