Tools

0xterror/cve-2026-81780-hash-form

Exploit for CVE-2026-81780: unauthenticated file upload in WordPress Hash Form plugin leading to remote code execution via crafted PHP payloads.

xmyronn/cve-2026-6184-stored-xss

Proof-of-concept for a stored XSS vulnerability in Simple Content Management System PHP, demonstrating session cookie theft via unsanitized News…

xmyronn/cve-2026-7089-xss

Proof-of-concept for CVE-2026-7089, a stored XSS in Home Service System PHP 1.0 allowing unauthenticated admin session hijacking via booking form.

xmyronn/cve-2026-6183-sqli

Proof-of-concept exploit for SQL injection in Simple Content Management System PHP, demonstrating UNION-based data extraction via the id parameter in…

xmyronn/cve-2026-6182-sqli-auth

Proof-of-concept for SQL injection authentication bypass in Simple Content Management System PHP, allowing unauthenticated attackers to gain admin…

xmyronn/cve-2026-7028-sqli

Proof-of-concept exploit for SQL injection in CodeAstro Online Job Portal allowing authenticated deletion of all job records via crafted GET request.

xmyronn/cve-2026-6201-idor

Proof-of-concept demonstrating an IDOR vulnerability in CodeAstro Online Job Portal allowing authenticated employers to delete arbitrary job postings…

shumerez/cve-2023-48858

Proof-of-concept exploit for CVE-2023-48858, a reflected XSS vulnerability in Armex ABO.CMS 5.9 login page, demonstrating injection of arbitrary web…

sangsenimanwartefak/cve-2025-6440

Exploit for CVE-2025-6440: unauthenticated arbitrary file upload in WooCommerce Designer Pro WordPress plugin, enabling RCE via malicious PHP upload.

ch4120n/cve-2026-3891

PoC for CVE-2026-3891 – Unauthenticated File Upload RCE in Pix for WooCommerce ≤ 1.5.0. Automated nonce retrieval, PHP upload, and command execution.

syfi/panaceasoft-0day-exploit

PanaceaSoft [all products] 0day exploit

febinrev/tinyfilemanager-2.4.3-exploit

A Path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager Project's Tiny File Manager <= 2.4.6…

ianxtianxt/vbulletin-5.x-0day-pre-auth-rce-exploit

Pre-authentication remote code execution exploit for vBulletin 5.x (versions 5.0.0 to 5.5.4). Provides a shell via widget_php widget. Use for…

d0n601/cve-2026-7537

MDJM Event Management <= 1.7.8.3 - Authenticated (Administrator+) Arbitrary File Upload via 'mdjm_email_upload_file' Parameter

owasp/vulnerable-web-application

OWASP Vulnerable Web Application Project https://github.com/hummingbirdscyber

nawed20002/cve-2023-30092

Proof-of-concept exploit for SQL injection in Sourcecodester Online Pizza Ordering System 1.0. Demonstrates remote code execution and denial of…

lichaser/cve-2024-12484

CVE-poc