CVE-2026-77647
nxploited/cve-2026-77647SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code
exploitationpayload-generationpenetration-testing+5
nxploited/cve-2026-77647SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code
0xblackash/cve-2026-111497Advisory and proof-of-concept toolkit for CVE-2026-111497 (Node2Shell), a Brotli heap overflow in Node.js, with trigger scripts, version checker, and…
ghxstsec/php2shell-pocPython exploit for CVE-2026-109618: abuses PHP session.upload_progress heap corruption to overwrite zend_call_function and achieve remote command…
yym8538/cve-2026-16723Proof-of-concept exploit for CVE-2026-16723, a Fastjson 1.x @JSONType remote code execution flaw, with a payload JAR builder and reverse-shell…
fl0ydsec/cve-2026-15989Mass scanner and exploit for CVE-2026-15989, the unauthenticated privilege escalation in Super Forms <= 6.3.316 that creates administrator accounts…
winrarzipsexploit/cve-2026-87930Joomla multi-CVE RCE suite with seven exploit modules for Balbooa Forms, Page Builder CK, SP Page Builder, JCE, iCagenda, Helix3, and SP LMS, plus…
cyberuser-hash/cve-2026-44011-craft-rce-pocPython proof-of-concept for CVE-2026-44011 in Craft CMS, exploiting authenticated remote code execution with command execution and base64-wrapped…
watchtowrlabs/watchtowr-vs-citrix-netscaler-cve-2026-88771Detection artifact generator for Citrix NetScaler CVE-2026-88771, exploiting a pre-auth command injection to achieve remote code execution against…
abraxas/cve-2026-48356Proof-of-concept and lab pack for CVE-2026-48356, an unauthenticated unrestricted file upload in Magento Open Source guest-cart REST custom options.
moi404/cve-2026-22686-remotecodeexecution-rce-pocProof-of-concept exploit and payload generator for CVE-2026-22686, a sandbox escape in enclave-vm <2.7.0 enabling arbitrary code execution and…
maxprog-svg/cve-2026-55040-mass-exploitExploit for CVE-2026-55040 in Microsoft SharePoint, forging JWT tokens via algorithm none, weak HS256 secrets, and RS256 substitution to impersonate…
open-flaw/cve-2026-25940Proof-of-concept for CVE-2026-25940 demonstrating embedded JavaScript execution via crafted AcroForm radio button appearances in PDF viewers, with…
mbanyamer/cve-2026-25961-sumatrapdf-3.5.0---3.5.2-rceSumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks # (using INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and do not…
mbanyamer/cve-2026-25916-roundcube-webmail-dom-based-xss-exploit-via-svg-href-attributePython exploit for Roundcube Webmail DOM-based XSS (CVE-2026-25916) via SVG href attributes, enabling session hijacking and data exfiltration through…
mbanyamer/-cve-2026-26215-manga-image-translator-rceProof-of-concept exploit for CVE-2026-26215, an unauthenticated remote code execution vulnerability in manga-image-translator via unsafe pickle…
cybercrewinc/cve-2026-36340Remote Code Execution (RCE) Vulnerability in Krayin CRM v2.1.5
simoesctt/sctt-2026-33-0007-the-ole-vortex-laminar-bypass-Microsoft just released emergency patches for CVE-2026-21509, a zero-day in the Office Suite that bypasses OLE/COM mitigations when a user simply…
securewithumer/cve-2026-20841PoC for a remote code execution flaw in Windows Notepad's markdown renderer. The markdown engine does not restrict URL protocols, allowing arbitrary…