Tools

yasserbdj96/hiphp

PHP-based backdoor tool for remote website control via HTTP/HTTPS. Enables file management, command execution, and Tor connectivity with…

arensballiu/cve-2026-33017-langflow-rce

Proof-of-concept for CVE-2026-33017, demonstrating unauthenticated remote code execution in vulnerable Langflow versions through malicious…

jonaschen0103/cve-2026-33439-poc

Python PoC exploiting CVE-2026-33439, a pre-auth RCE in OpenAM via Java deserialization of the jato.clientSession parameter, with interactive and…

rootxn/cve-2026-12793

Python PoC for CVE-2026-12793 in JetFormBuilder <= 3.6.2: unauthenticated privilege escalation leading to plugin upload and remote code execution,…

hd-exe/cve-2009-2265-fix

fix for not working exploit script on exploitdb (50057.py)

e5dfdd568a75282b712b6d93a7a18e12/cve-2025-24813

Python PoC exploiting CVE-2025-24813, an Apache Tomcat partial PUT deserialization RCE. Auto-detects vulnerable variants, supports blind command…

e5dfdd568a75282b712b6d93a7a18e12/cve-2025-32432

Python exploit for CVE-2025-32432, an unauthenticated RCE in Craft CMS via Yii2 __class injection, with command execution and reverse shell support.

ac8999/cve-2025-27636-rce-in-apache-camel

Python PoC exploiting CVE-2025-27636, an Apache Camel header injection RCE, supporting command execution, file reads, and reverse shell payloads.

0xcyp1337/cve-2026-44402

Exploit for CVE-2026-44402 targeting Voltronic Power SNMP Web Pro 1.1, enabling unauthenticated remote code execution via malicious firmware upload.…

hackplayers/evil-winrm

The ultimate WinRM shell for hacking/pentesting

ahseven/cve-2026-33017-poc-reverse-shell

Exploit for CVE-2026-33017, an unauthenticated RCE in Langflow, enabling reverse shell via malicious CustomComponent payload.

daemoncibsec/mcpexec

POC for CVE-2026-23744 for a python revshell

zildanz/cve-2026-64638

Node.js exploit for CVE-2026-64638 that runs an ngrok tunnel to a malicious endpoint, enabling remote access and post-exploitation control.

unpredictable21/cve-2026-75430_powerjob_worker_deploycontainer_rce

Proof-of-concept exploit for CVE-2026-75430, achieving unauthenticated remote code execution on PowerJob Worker via arbitrary JAR loading through the…

ezramansor/cve-2025-32432-poc

A simple PoC on the Remote Code Execution (RCE) Vulnerability of CraftCMS designated as CVE-2025-32432 written in Go

joelgmsec/http-shell

Multiplatform HTTP reverse shell providing a shell-like interface over HTTP, with file upload/download, command history, auto-reconnection, and sudo…

joelgmsec/pyshell

Multi-platform Python webshell providing remote shell access on web servers with command history, file upload/download, and directory traversal…