Tools

berraesen/nextjs-middleware-auth-bypass-lab

Deliberately vulnerable Next.js lab demonstrating CVE-2025-29927 middleware authorization bypass. Includes Dockerized app, middleware-protected admin…

mobetasec/cve-2024-1813-poc

PoC exploit for CVE-2024-1813: PHP object injection in Simple Job Board WordPress plugin, achieving unauthenticated RCE via gadget chain. Includes…

joaovicdev/exploit-cve-2026-40901

Automated exploit for DataEase: 4-vulnerability chain (auth bypass, JDBC blocklist bypass, SQL injection, Java deserialization) achieving…

learner202649/cve-2026-47102-poc

The code for personally reproducing the corresponding vulnerability

joaovicdev/exploit-cve-2026-63030

Docker-based vulnerable WordPress lab with Python exploit demonstrating pre-auth route confusion and SQL injection chain (CVE-2026-63030 +…

nakiami/mellivora

PHP-based CTF engine for hosting capture-the-flag competitions with arbitrary challenges, scoreboards, hints, team management, and admin console.…

exp-docs/cve-2019-5475

Docker-based lab environment for exploiting CVE-2019-5475 and CVE-2019-15588 RCE command injection vulnerabilities in Nexus Repository Manager with…

yoryio/cve-2024-27198

Python exploit for CVE-2024-27198, an authentication bypass vulnerability in JetBrains TeamCity Server. Creates a new admin user on vulnerable…

ihk-one/cve-2025-2502

Step-by-step demonstration of a local privilege escalation vulnerability in Lenovo PC Manager, exploiting weak file permissions on a system service…

m0d0ri205/wargame_re-ls

CTF challenge exploiting CVE-2025-0184 DOCX SSRF vulnerability to access internal admin service and retrieve a flag. Includes exploit generator and…

pouriam23/next.js-middleware-bypass-cve-2025-29927-

CTF challenge to learn and practice exploiting the Next.js middleware bypass vulnerability (CVE-2025-29927) by finding a flag in an admin page.

all3njk/nextjs_cve-2025-29927

Demonstrates the x-middleware-subrequest header bypass in Next.js 13.4.19, allowing unauthorized access to protected routes. Includes setup, normal…

lilly-dox/exploit-cve-2023-22518

Exploit for CVE-2023-22518 in Atlassian Confluence. Provides a detailed walkthrough of the vulnerability, including environment setup, root cause…

whisperer1290/cve-2025-54309__enhanced_exploit

Multi-threaded exploit for CrushFTP authentication bypass (CVE-2025-54309) with race condition implementation, XML payload generation, and admin user…

ne0zer01/cve-2024-27198_lab

Docker-based lab for CVE-2024-27198 TeamCity authentication bypass. Includes exploit reproduction, IoC hunting with Sigma/Suricata rules, and…

hunt3r850/cve-2024-10924-wordpress-docker

Dockerized exploit environment for CVE-2024-10924, an authentication bypass in WordPress Really Simple Security plugin (versions 9.0.0-9.1.1.1)…

iamnewbiez/cve-2021-44228

Deliberately vulnerable Apache Solr application (CVE-2021-44228) for practicing Log4Shell exploitation via User-Agent, POST, and admin endpoints.…