Tools

cckuailong/log4j_dos_cve-2021-45105

PoC exploit for CVE-2021-45105 (Log4j2 DOS) with Spring Boot web app, demonstrating infinite loop via crafted HTTP header/body payloads.

ludy-dev/vbulletin_routestring-rce

PoC exploit for CVE-2019-16759 enabling remote code execution on vBulletin 5.0.0–5.6.2 via malicious POST request due to input validation flaw.

darryk10/cve-2022-22963

Proof-of-concept exploit for CVE-2022-22963 (Spring4Shell) with a vulnerable Docker container and curl-based remote code execution via Spring Cloud…

george0papasotiriou/cve-2026-11112-xxe-via-svg-image-upload

Demonstrates XXE via SVG upload with a vulnerable Flask/lxml parser and an exploit script for arbitrary file read, SSRF, and denial-of-service…

cyberxml/log4j-poc

A Docker based LDAP RCE exploit demo for CVE-2021-44228 Log4Shell

lyonzon2/browser-crash-tool

Automated browser crash tool exploiting CVE-2020-27950 (iOS WebKit) via Metasploit and ngrok. Generates public malicious URL for controlled…

m2hcz/cve-2025-6440-poc-exploit

Unauthenticated remote code execution exploit for the WC Designer Pro WordPress plugin. Automates detection, file upload, and shell access via a…

rohit-sundar/cve-2026-23744

Proof-of-concept exploit for CVE-2026-23744, an unauthenticated RCE in MCPJam Inspector. Provides reverse shell and command execution via a…

jptr218/struts_hack

Exploit tool for Apache Struts CVE-2017-5638, using OGNL injection to gain remote access to vulnerable servers via command-line interface.

jiansiting/cve-2019-3719

Proof-of-concept exploit for CVE-2019-3719, a remote code execution vulnerability in Dell SupportAssist. Executes arbitrary payloads against…

loaxert/cve-2018-15133-poc

Python exploit for CVE-2018-15133, achieving remote code execution on vulnerable Laravel applications via insecure deserialization of encrypted…

garux-sec/poc-react2shell-cve-2025-55182

Proof-of-concept exploit for CVE-2025-55182, demonstrating remote code execution via a React-based application to achieve a reverse shell.

masahiro331/cve-2020-11984

Dockerized exploit for CVE-2020-11984 enabling remote command execution on vulnerable web servers via a Python-based payload.

svchostmm/cve-2024-25600-mass

Mass exploit for CVE-2024-25600, uploading webshells to vulnerable WordPress sites via a list of targets.

anthemtotheego/sharpsploitconsole

C# console application for post-exploitation and red team operations, integrating SharpSploit to execute Mimikatz commands, perform Kerberoasting,…

hunters-sec/cve-2025-55188-7z-exploit

Proof-of-concept exploit for CVE-2025-55188 demonstrating arbitrary file write via symlink traversal in vulnerable 7-Zip versions prior to 25.01.

dacade/cve-2020-1938

Exploit for CVE-2020-1938 (Ghostcat) enabling file read and remote command execution on vulnerable Apache Tomcat servers via the AJP connector.