Tools

xshadow-here/cve-2026-0740

Automated mass exploiter for CVE-2026-0740, an unauthenticated arbitrary file upload in Ninja Forms File Uploads plugin, enabling remote code…

ivansmc/cve-2025-10353-poc

Exploit for CVE-2025-10353. Unauthenticated File Upload on Melis Platform Framework that leads to RCE

simoesctt/sctt-2026-33-0007-the-ole-vortex-laminar-bypass-

Microsoft just released emergency patches for CVE-2026-21509, a zero-day in the Office Suite that bypasses OLE/COM mitigations when a user simply…

absholi7ly/elementor-pro-unauthenticated-arbitrary-file-upload-to-rce

CVE-2026-32475 The Elementor Pro Forms File Upload field handles validation and file processing in two separate loops with different handling of…

superman-l/cve-2026-16723

Reproduces fastjson 1.2.83 @JSONType RCE with a vulnerable Spring Boot target and ASM-based payload generator using HTTP or file protocol jar chains.

jpsbern/cve-2023-4863

Generates WebP images that trigger CVE-2023-4863 heap buffer overflow in libwebp, using tunable OFFSET/VALUE constants for exploit testing and…

lolw0/opensta-exploit

Proof of Concept (PoC) of CVE-2025-69212 related with P7M File Processing

ariary/dogwalk-rce-poc

🐾Dogwalk PoC (using diagcab file to obtain RCE on windows)

iilegacyyii/shellcrypt

A QoL tool to obfuscate shellcode. In the future will be able to chain encoding/encryption/compression methods.

tsuyoken/imgbackdoor

Hide your payload into .jpg file

frank2/blenny

A payload delivery system which embeds payloads in an executable's icon file!

george0papasotiriou/cve-2026-11112-xxe-via-svg-image-upload

Demonstrates XXE via SVG upload with a vulnerable Flask/lxml parser and an exploit script for arbitrary file read, SSRF, and denial-of-service…

sn0x-sharma/cve-2026-18718

Found a 0-Day in Ghidra: Shared Project File Became a Code Execution Vector

george0papasotiriou/cve-2026-21013-pdf-javascript-injection-via-embedded-script

Generates a PDF with embedded JavaScript to demonstrate CVE-2026-21013, an OpenAction injection leading to script execution in vulnerable PDF readers.

shinthink/cve-2026-63223

CVE-2026-63223 — CI4RCE: CodeIgniter 4 is_image/mime_in File Upload RCE. Magic bytes bypass (getExtension vs getClientExtension). CVSS 9.8 | CWE-434…

0xdak/cve-2026-52680_exploit

Exploit for Apache Kyuubi path traversal (CVE-2026-52680) achieving unauthenticated arbitrary file write and code execution via profile.d shell…

cblabresearch/clematis

PE to shellcode

imbas007/cve-2026-63223-poc

CVE-2026-63223 PoC — CodeIgniter 4 is_image/mime_in File Upload RCE (CVSS 9.8). Unauthenticated remote code execution via unrestricted file upload…