Tools

heltonpojo/cve-2025-32432

Pre-auth RCE exploit for Craft CMS in Go. Grabs session/CSRF token, poisons PHP session, triggers deserialization for command execution or reverse…

bahaabdelwahed/killshot

A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner

dr-iman/cve-2018-7600-drupal-0day-rce

Perl-based remote code execution exploit targeting CVE-2018-7600 in Drupal CMS, enabling payload upload and server compromise.

wytchwulf/cve-2015-1397-magento-shoplift

Exploit scripts for CVE-2015-1397 in Magento CMS, including a pre-auth exploit to gain admin credentials and a post-auth RCE module for reverse shell…

caginkyr/cve-2026-5203

Exploit for CVE-2026-5203 in CMS Made Simple, leveraging path traversal and arbitrary file upload to achieve remote code execution with an…

gl1tch0x1/ghost-cms-exploit

Python script that brute-forces Ghost CMS credentials, then checks for CVE-2024-23724 and generates an SVG exploit payload for confirmed vulnerable…

charlesgargasson/cve-2023-41425

XSS-to-RCE exploit for Wonder CMS 3.2.0–3.4.2 with automated payload delivery, reverse shell, and cookie theft via malicious theme installation.

raffli-dev/cve-2023-41425

Exploit for Wonder CMS XSS to RCE (CVE-2023-41425) with theme upload and reverse shell payloads.

caelumisme/cve-2020-29607-poc

Python 3 exploit for Pluck CMS 4.7.13 file upload restriction bypass, enabling authenticated admin to upload a PHP webshell and achieve remote code…

swammers8/wbce-v1.6.3-authenticated-rce

Authenticated RCE exploit for WBCE CMS <= 1.6.3 that creates a malicious module zip with a PHP reverse shell and netcat listener.

can0i0ever0enter/cve-2023-45878

Python exploit for CVE-2023-45878, an unauthenticated arbitrary file upload in Gibbon CMS, enabling RCE via webshell upload and interactive shell…

ahajnik/cve-2022-34919

Proof-of-concept exploit for CVE-2022-34919, demonstrating unauthenticated arbitrary file upload and RCE in Contensis CMS Classic interface via…

jeanback1/cve-2025-2304-exploit

Python exploit script for CVE-2025-2304, a mass assignment privilege escalation in Camaleon CMS. Automates CSRF token parsing and role parameter…

soch4n/cve-2018-7600

Python exploit for CVE-2018-7600 (Drupalgeddon2) targeting remote code execution in Drupal CMS. Designed for penetration testing and vulnerability…

s1lentf00thold/cve-2021-21425-rce

Python exploit script for CVE-2021-21425 targeting Grav CMS admin panel, delivering a reverse shell via HTTP POST request with configurable LHOST and…

h3x0v3rl0rd/cve-2022-41544

Python exploit script for CVE-2022-41544 in GetSimple CMS. Automates API key leakage, CSRF token extraction, PHP shell upload, and reverse shell…

0x0d3ad/cve-2023-41425

Automated Python exploit for CVE-2023-41425, chaining stored XSS to remote code execution in Wonder CMS 3.2.0 through 3.4.2. Enables authenticated…