Tools

khush-613/cve-2026-44011-poc

Python proof-of-concept exploit for CVE-2026-44011, an authenticated RCE in Craft CMS via Yii behavior injection, with two-stage command output…

c0gnit00/cve-2025-32432

Exploit, POC for CVE-2025-32432, CraftCMS2Shell

tranphuc2005/cve-2017-9822

Detailed analysis and proof-of-concept exploit for CVE-2017-9822, an XXE/insecure deserialization vulnerability in DotNetNuke CMS leading to remote…

vidura2/cve-2024-46986

Automated Python exploit for Camaleon CMS arbitrary file upload vulnerability (CVE-2024-46986). Supports reverse shell and command execution payloads…

anirbala98/cve-2026-67206

PoC exploit for Wolf CMS <= 0.8.3.1: authenticates to Admin, writes an arbitrary PHP file to /public via FileManagerController, and executes commands…

binneko/cve-2025-50286

Authenticated RCE exploit for Grav CMS via plugin upload, demonstrating arbitrary PHP code execution and reverse shell.

rootxran/cve-2026-29053

Proof-of-concept exploit for Ghost CMS remote code execution via prototype pollution in jsonpath and static-eval, with a vulnerable environment setup…

estebanzarate/cve-2020-29607-pluck-cms-4.7.13-authenticated-file-upload-rce-poc

Authenticated RCE exploit for Pluck CMS <= 4.7.13 via unvalidated file upload. Uploads a PHP webshell and provides an interactive command shell.

yahiahamza/cve-2026-25099

Python exploit for Bludit CMS API unrestricted file upload leading to remote code execution, providing command execution and interactive shell for…

princeaikinsbaidoo/cve-2022-41840-poc

This is the PoC exploit for CVE-2022-41840, running Zenario

brunopincho/cve-2018-16763-rust

Rust implementation of an exploit for CVE-2018-16763, targeting a remote code execution vulnerability in Fuel CMS for penetration testing and…

k0nnect/halo-cve-2026-67919

halo cms plugin 1-request rce from a url, PoC + exploit chain

purgemebaby/cve-2018-11736

PoC exploit for CVE-2018-11736 affecting Pluck CMS versions prior to 4.7.7-dev2 with a File Upload Vulnerability

mbadanoiu/magnolia-8281

MAGNOLIA-8281: FreeMarker Restriction Bypass 2 in Magnolia CMS

p34nut2/cve-2025-32432-exploit-by-p34nut

Reliable CVE-2025-32432 pre-auth RCE exploit for Craft CMS 3.x/4.x/5.x, works where other public PoCs fail

themursalin/cve-2025-32432

Exploit for Craft CMS pre-authentication RCE (CVE-2025-32432) chaining session poisoning with insecure deserialization to execute arbitrary commands…

cd-ratel/cve-2025-32432

Working PoC for CVE-2025-32432 - Craft CMS <= 5.6.16 unauthenticated RCE via Yii2 PhpManager gadget + nginx access.log poisoning

crukz404/cve-2019-10068-poc

Proof-of-concept exploit for CVE-2019-10068, a deserialization RCE in Kentico CMS, that uploads a web shell for remote command execution.