Tools

0x00-0x00/cve-2015-3224

Metasploit module for CVE-2015-3224 that enables arbitrary command execution in Ruby on Rails Web Console by extending the original RCE module with…

cyberdefenseinstitute/poc_cve-2016-2098_rails42

Proof-of-concept exploit for CVE-2016-2098, demonstrating remote code execution via template injection in Rails 4.2.5.1 view rendering.

shelld3v/cve-2012-2688

Exploit shell for CVE-2012-2688, providing remote code execution against vulnerable Ruby on Rails applications via a crafted HTTP request.

debalinax64/cve-2016-2098

Proof-of-concept exploit script for CVE-2016-2098, a remote code execution vulnerability in Ruby on Rails' Action Pack render method. Executes…

forced-request/rails-rce-cve-2016-0752

Proof-of-concept exploit for CVE-2016-0752, a remote code execution vulnerability in Ruby on Rails via dynamic render paths. Includes vulnerable app,…

alejandro-marting/rails-poc-cve-2016-2098

Proof of concept for CVE-2016-2098, demonstrating remote code execution via template injection in Rails 4.2.5.1 with curl commands and reverse shell…

cliffe/breakescape

Mountable Rails engine providing 24+ cybersecurity escape room scenarios with randomized passwords, JIT-compiled NPC dialogue, and RESTful API for…

adversarial-detection-engineering/adversarial-detection-engineering-framework

A framework and taxonomy for identifying, classifying, and reasoning about detection logic bugs in SIEM, EDR, and XDR rules, with concrete examples…

nickguitar/joomla-jck-editor-6.4.4-sql-injection

SQL injection exploit for Joomla JCK Editor 6.4.4 (CVE-2018-17254) that dumps admin credentials and optionally uploads a PHP RCE shell via stacked…

wi1dn00b/cve-2024-55968

Proof-of-concept exploit for CVE-2024-55968, a macOS local privilege escalation via an unvalidated XPC helper in DTEX Event Forwarder, abusing the…

wojtekchwala/cve-2025-66849

Proof-of-concept exploit for a stored XSS vulnerability in Ghost CMS (CVE-2025-66849) enabling privilege escalation from Contributor to Owner via…

caginkyr/cve-2026-5203

Exploit for CVE-2026-5203 in CMS Made Simple, leveraging path traversal and arbitrary file upload to achieve remote code execution with an…

cherrling/cve-2025-56499

Proof-of-concept exploit for CVE-2025-56499, demonstrating arbitrary file read via missing path validation in mihomo's rule-provider configuration,…

lu3ky13/alternative-approach-reverse-shell-callback-test-invokeai-rce

Alternative payloads for InvokeAI RCE (CVE-2024-12029) including reverse shells, callback tests, and SSH injection bypasses for pickle…

advaitpathak21/cve-2024-46987

Python proof-of-concept for authenticated path traversal (CWE-22) in Camaleon CMS, enabling arbitrary file read via crafted requests to…

george0papasotiriou/cve-2025-15556-notepad-wingup-updater-rce

Proof-of-concept exploit for CVE-2025-15556, demonstrating update integrity bypass in Notepad++ WinGUp updater via MITM proxy or DNS spoofing,…

bytereaper77/cve-2025-7840

Proof‑of‑concept exploit for CVE‑2025‑7840 that injects malicious payloads into the Firstname parameter of a reservation form to trigger XSS

blacklanternsecurity/badsecrets

A library for detecting known secrets across many web frameworks