Tools

cduram/chirp-codeexecution_via_malicious_imagefile

Proof-of-concept exploit for arbitrary code execution through eval() injection in a ham radio programming application, including malicious .itm/.img…

velessecurity/cve-2020-14882-weblogic-analysis

Technical analysis and clean Java Thread Echo PoC for Oracle WebLogic Server vulnerability chain.

jendmaoul/xss2shell-cve-2026-64638

CVE-2026-64638 — WordPress Pre-Auth Reflected XSS → RCE via DOM Clobbering + Application Password Theft + REST API Plugin Activation. Dual-mode PoC…

anggatechi/cve-2026-63077

CVE-2026-63077 — Unauthenticated Remote Code Execution in JetBrains TeamCity via agent polling protocol deserialization. CVSS 9.8 CRITICAL. Mass…

razureink/cve-2026-0770-langflow_rce_reproduction

CVE Reproduction: cve-2026-0770-langflow_rce_reproduction

iss4cf0ng/nebulapulsar

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of…

mobetasec/cve-2024-1813-poc

PoC exploit for CVE-2024-1813: PHP object injection in Simple Job Board WordPress plugin, achieving unauthenticated RCE via gadget chain. Includes…

sangsenimanwartefak/cve-2026-45034

PoC exploit for PHPSpreadsheet's phar:// deserialization vulnerability, bypassing prohibitWrappers to achieve remote code execution on vulnerable PHP…

inforcqb/cve-2026-0013-exploit

Proof-of-concept exploit for CVE-2026-0013, demonstrating a remote code execution vulnerability in a target application. Includes payload generation…

mzfr/liffy

Local file inclusion exploitation tool

contrast-security-oss/spring-kafka-poc-cve-2023-34040

POC for Spring Kafka Deserialization Vulnerability CVE-2023-34040

damariion/cve-2015-8522.rce

Exploit for CVE-2015-8522 targeting Tivoli FastBack Server with stack-based buffer overflow, ASLR/DEP bypass, and automated reverse-shell…

frkngksl/exporthider

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

azefzafyoussef/cve-2026-33229

Proof-of-concept exploit for CVE-2026-33229, an XWiki RCE via Apache Velocity sandbox bypass, with technical details and a working payload.

s4dp4nd4/frida-c2-mcp

Agentic C2-style MCP server for Frida instrumentation on rooted Android and jailbroken iOS.

imjdl/cve-2026-31816-rshell

Exploits CVE-2026-31816 in Budibase to bypass authentication, upload a malicious datasource plugin, and execute a reverse shell for remote access.

cianananan/cve-2019-10068-poc

Proof of concept exploit for CVE-2019-10068.