Tools

tranphuc2005/cve-2017-9822

Detailed analysis and proof-of-concept exploit for CVE-2017-9822, an XXE/insecure deserialization vulnerability in DotNetNuke CMS leading to remote…

anirbala98/cve-2026-67206

PoC exploit for Wolf CMS <= 0.8.3.1: authenticates to Admin, writes an arbitrary PHP file to /public via FileManagerController, and executes commands…

vidura2/cve-2024-46986

Automated Python exploit for Camaleon CMS arbitrary file upload vulnerability (CVE-2024-46986). Supports reverse shell and command execution payloads…

binneko/cve-2025-50286

Authenticated RCE exploit for Grav CMS via plugin upload, demonstrating arbitrary PHP code execution and reverse shell.

estebanzarate/cve-2020-29607-pluck-cms-4.7.13-authenticated-file-upload-rce-poc

Authenticated RCE exploit for Pluck CMS <= 4.7.13 via unvalidated file upload. Uploads a PHP webshell and provides an interactive command shell.

yahiahamza/cve-2026-25099

Python exploit for Bludit CMS API unrestricted file upload leading to remote code execution, providing command execution and interactive shell for…

rootxran/cve-2026-29053

Proof-of-concept exploit for Ghost CMS remote code execution via prototype pollution in jsonpath and static-eval, with a vulnerable environment setup…

princeaikinsbaidoo/cve-2022-41840-poc

This is the PoC exploit for CVE-2022-41840, running Zenario

brunopincho/cve-2018-16763-rust

Rust implementation of an exploit for CVE-2018-16763, targeting a remote code execution vulnerability in Fuel CMS for penetration testing and…

k0nnect/halo-cve-2026-67919

halo cms plugin 1-request rce from a url, PoC + exploit chain

purgemebaby/cve-2018-11736

PoC exploit for CVE-2018-11736 affecting Pluck CMS versions prior to 4.7.7-dev2 with a File Upload Vulnerability

mbadanoiu/magnolia-8281

MAGNOLIA-8281: FreeMarker Restriction Bypass 2 in Magnolia CMS

themursalin/cve-2025-32432

Exploit for Craft CMS pre-authentication RCE (CVE-2025-32432) chaining session poisoning with insecure deserialization to execute arbitrary commands…

cd-ratel/cve-2025-32432

Working PoC for CVE-2025-32432 - Craft CMS <= 5.6.16 unauthenticated RCE via Yii2 PhpManager gadget + nginx access.log poisoning

is4yev/cve-2026-48909

Proof-of-concept exploit for CVE-2026-48909: unauthenticated remote code execution via PHP object injection in JoomShaper SP LMS. Includes detection,…

groppoxx/cve-2020-25042-poc

PoC for CVE-2020-25042: automated Mara CMS 7.5 authenticated PHP upload to RCE, with login hash handling, shell reuse, custom payload support, and…

saadhassan77/spip-bigup-unauthenticated-rce-exploit-cve-2024-8517

This Python exploit targets a critical unauthenticated Remote Code Execution (RCE) vulnerability in the BigUp plugin of SPIP CMS (≤ 4.3.1, 4.2.15,…