Tools

trailofbits/not-going-anywhere

Intentionally vulnerable Golang programs exposing web, gRPC, and database/sql flaws for security training, vulnerability discovery, and remediation…

mthamil107/db_audit_research

Self-Defeating Audits: reproducible lab showing a low-privilege PostgreSQL role reversibly blinding a trigger-based auditor + poisoning attribution…

hackspeak/cve-2026-14669

Proof-of-concept exploit for CVE-2026-14669, a PostgreSQL to_char() timezone abbreviation heap buffer overflow enabling RCE through information leak…

arpeetrathii/50-days-of-sqli

Learning and hunting SQL injection bugs for 50 continuous days

ignitetechnologies/mssql-pentest-cheatsheet

Practical MSSQL penetration testing cheat sheet covering enumeration, linked-server pivoting, privilege escalation, persistence, and command…

dinosn/mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE lab — priv-esc + heap UAF + JOP chain to system() as uid 999(mysql) on stock Docker image. Found with RAPTOR and…

raminfp/redis_exploit

Educational PoC lab for Redis CVE-2025-49844 (RediShell), a use-after-free in the Lua interpreter; Dockerized vulnerable instance and modular RCE…

hunt-benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout

PoC exploit for CVE-2026-17543: SQL injection in PHP ext/pgsql via backslash breakout, with data exfiltration and admin privilege-escalation payloads…

imbas007/poc-cve-2026-58048

PoC exploit for CVE-2026-58048, an authenticated cPanel SQL injection that escalates to MySQL root and supports file-read, webshell, and RCE payloads.

rizlmaulanaa/cve-2026-23479-redis-uaf-proof-of-concept

Proof of concept with GDB‑assisted exploitation (educational / lab use only)

biitts/cve-2026-52887-nocobase-sqli-rce

CVE-2026-52887 — NocoBase SQL injection -> PostgreSQL-superuser RCE (myInAppChannels:list filter, CVSS 10.0). Author PoC + source analysis + docker…

luuanhduc/cve-2021-35042

Proof-of-concept exploit for CVE-2021-35042, a Django SQL injection vulnerability in QuerySet.order_by(), with Docker-based lab environment for…

mr-xn/cve-2026-8054

Detailed analysis and reproduction guide for CVE-2026-8054, a pre-auth SQL injection in dotCMS Publish Audit API, including exploit payloads, Docker…

ywh-jfellus/cve-2026-65761

Proof-of-concept for CVE-2026-65761: unauthenticated SQL injection via filter_sortby in EasyStore Joomla, with Docker lab for testing and patching.

giangdurian/cve-2026-63030-cve-2026-60137

Pre-auth RCE exploit for WordPress (CVE-2026-63030 + CVE-2026-60137) chaining route confusion and SQL injection into full shell access. Includes…

yeonchoda/cve-2024-9264

PoC exploit for CVE-2024-9264: Grafana SQL Expression vulnerability enabling local file inclusion and remote code execution via DuckDB SQL injection.…

rideckszz/poc-cve-2019-9053

Educational Python 3 proof-of-concept for CVE-2019-9053, a time-based blind SQL injection in CMS Made Simple <= 2.2.9. Adapted for CTF/lab use with…