Tools

muhammedkayag/cve-2025-32463

Proof-of-concept demonstrating a local privilege escalation in sudo (CVE-2025-32463) via chroot configuration manipulation, intended for defensive…

lastvocher/redis-cve-2025-49844

Educational lab environment with a proof-of-concept exploit for CVE-2025-49844 (RediShell), a critical use-after-free in Redis Lua interpreter,…

kanitan/log4j2-web-vulnerable

A vulnerable web app for log4j2 RCE(CVE-2021-44228) exploit test.

imjdl/cve-2026-42208_lab

Reproduction environment for a critical SQL injection in LiteLLM Proxy's API key authentication, with a time-based blind PoC and Docker setup for…

gavz/cve-2026-21509-poc

Educational PoC generating a harmless DOCX with dummy OLE artifacts to test EDR/AV visibility, ASR rules, and sandbox analysis for CVE-2026-21509.…

dinosn/ghost-cve-2026-26980

CVE-2026-26980 — Ghost CMS Content API SQL Injection Lab (unauthenticated blind SQLi via slug filter ordering)

carlosalbertotuma/cve-2026-2058-poc

Proof-of-concept exploit for CVE-2026-2058, a SQL injection in CloudClassroom PHP Project, with automated database enumeration and data extraction.

av4nth1ka/jinjava-cve-2026-25526-poc

Step-by-step exploit harness and proof-of-concept for CVE-2026-25526 in Jinjava, demonstrating file read, file creation, and info disclosure with…

androidteacher/cve-2026-24061-poc-telnetd

Proof-of-concept exploit for CVE-2026-24061, an unauthenticated remote root privilege escalation in inetutils-telnetd via USER environment variable…

amusedx/cve-2026-22686

CTF challenge focused on sandbox escape via source code review of a JavaScript execution environment, designed for hands-on vulnerability analysis…

adilkurtulmus/linux-copy-fail-cve-2026-31431

Proof-of-concept exploit for CVE-2026-31431 (Copy-Fail), a Linux kernel AF_ALG and splice() flaw enabling page cache poisoning and local privilege…

abhayclasher/cve-2026-39866

Proof-of-concept lab demonstrating command injection in GitHub Actions workflow dispatch (CVE-2026-39866). Runs vulnerable and patched versions…

abhayclasher/cve-2026-33331

Local lab reproducing stored XSS in oRPC's OpenAPI docs generation (CVE-2026-33331), with vulnerable and patched versions for comparison and a…

thecybergeek/cve-2026-3888-snap-confine-systemd-tmpfiles-lpe

Local privilege escalation exploit for CVE-2026-3888 targeting snap-confine and systemd-tmpfiles on Ubuntu, providing SUID and capabilities variants…

sowatkheang/cve_2026_2576_poc

CVE-2026-2576 — Business Directory Plugin SQLi PoC (Local Setup). Unauthenticated Time-Based Blind SQL Injection Business Directory Plugin for…

shreda/cve-2026-33032-nginx-ui-vuln-lab

Docker Compose setup to demonstrate the nginx-ui missing authentication vulnerability

pinkarmor/cve-2025-1094-lab-setup

Hands-on lab to exploit CVE-2025-1094, a PostgreSQL psql SQL injection leading to RCE via COPY TO PROGRAM, with Docker setup and reverse shell…

mkway/cve-2026-3304

Reproduction lab for CVE-2026-3304, a Multer async fileFilter race condition causing disk exhaustion via orphaned temp files. Includes vulnerable and…