Tools

ch4120n/cve-2026-55579

Python exploit for CVE-2026-55579, an unauthenticated RCE in Pheditor via hardcoded default credentials. Executes commands and uploads files through…

hakluke/weaponised-xss-payloads

JavaScript payloads that weaponize XSS bugs into critical impact, enabling account takeover and admin creation on popular CMS platforms for pentest…

zer0condition/zerohvci

Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling without admin…

diego-tella/cve-2024-27956-rce

Proof-of-concept exploit for CVE-2024-27956, a SQL injection in ValvePress Automatic WordPress plugin. Automates user creation with admin privileges…

jonaslejon/ad-autopwn

Automated Active Directory attack chain from zero-auth to Domain Admin. Chains 25+ techniques including Kerberoast, AD CS ESC1-16, Shadow…

tarantula-team/cve-2019-12949

Proof-of-concept exploit demonstrating XSS-to-RCE chain in pfSense 2.4.4-p2/p3 via phishing, with custom JavaScript and PHP webshell payloads for…

mhtsec/cve-2026-63030

Pre-auth SQL injection to remote code execution exploit for WordPress REST API batch endpoint. Creates admin account and executes system commands via…

jas502n/cve-2015-5254

Exploit for ActiveMQ deserialization RCE (CVE-2015-5254) using jmet to send crafted serialized payloads via OpenWire port 61616, with command…

boku7/cve-2020-23839

Exploit for CVE-2020-23839, a reflected XSS in GetSimple CMS v3.3.16 admin login, chaining to remote code execution via a PHP backdoor WebShell.

minhhk68/cve-2026-13158

Proof-of-concept exploit and technical advisory for an Admin+ arbitrary file upload to remote code execution vulnerability in Everest Toolkit…

teteren/cve-2025-57819-rce

PoC exploit for FreePBX 16 chaining CVE-2025-57819 (unauthenticated stacked SQL injection) and CVE-2025-61678 (arbitrary file upload/path traversal)…

gagaltotal/cve-2026-63030-cve-2026-60137-wp2shell-poc

Proof-of-concept exploit for WordPress REST API time-based blind SQL injection (CVE-2026-63030, CVE-2026-60137) with full chain escalation to remote…

dungsocool/cve-2026-64638

Proof-of-concept exploit for CVE-2026-64638: reflected XSS in WordPress login chained with DOM clobbering to achieve admin account takeover and…

secforce/wptimecapsulepoc

Exploit for authentication bypass in WP Time Capsule plugin (<1.21.16). Steals admin cookie and uploads webshell.

hoangkien1020/cve-2020-24597

Exploit for Joomla core directory traversal (CVE-2020-24597) enabling remote code execution via admin account, with PoC script for privilege…

anirbala98/cve-2026-67206

PoC exploit for Wolf CMS <= 0.8.3.1: authenticates to Admin, writes an arbitrary PHP file to /public via FileManagerController, and executes commands…

administrator-01001/cve-2026-63030

Proof-of-concept exploit for CVE-2026-63030 chaining REST API route confusion, SQL injection, oEmbed cache poisoning, and Customizer privilege…