merlin
ne0nd0g/merlinMerlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
command-and-controldata-exfiltrationexploit-frameworks+10
ne0nd0g/merlinMerlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
fortra/impacketPython library for low-level network protocol manipulation, featuring SMB, MSRPC, Kerberos, and WMI implementations with tools for authentication…
tonydelouvre/cve-2026-102425GUI scanner and exploit for CVE-2026-102425, an unauthenticated RCE in Balbooa Forms (com_baforms) via PHP shortcode injection, with mass scanning…
cyberuser-hash/cve-2026-44011-craft-rce-pocPython proof-of-concept for CVE-2026-44011 in Craft CMS, exploiting authenticated remote code execution with command execution and base64-wrapped…
shadowforge-cyber/cve-2026-65660-pocMalicious Register Directive Code Injection Exploit
adaptix-framework/adaptixc2AdaptixC2 is a highly modular advanced redteam toolkit
digiprosec/microtrickSelf-contained Python PoC exploiting the MikroTrick SSH chain (CVE-2026-86060, CVE-2026-67279) to gain unauthenticated full admin access on MikroTik…
not-sekiun/pyirisPyIris is a modular remote access trojan toolkit written in python targeting Windows and Linux systems.
maxprog-svg/cve-2026-33017CVE-2025-62593 — Ray Unauthenticated RCE Exploit is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine.
rafabd1/cve-2026-75604-pocProof-of-concept exploit for CVE-2026-75604, an unauthenticated remote code execution in Windows-hosted Next.js apps, with callback-based command…
mythicagents/xenonA Mythic agent for Windows written in C
unpredictable21/cve-2026-75429_powerjob_friend_process_rceUnauthenticated remote code execution exploit for PowerJob Server via Groovy injection in the /friend/process endpoint, enabling arbitrary command…
iicaicai/cve-2026-5524-pocPython mass-exploit toolkit for CVE-2026-5524, an unauthenticated file upload RCE in the WordPress Divi Form Builder plugin, with webshell upload and…
sermikr0/cve-2026-38426CVE-2026-38426 — strcpy() Stack Buffer Overflow in Tasmota fetch_jpg() boundary[40] (Tasmota <= 15.3.0.3)
bannt08/research-cve-2026-21858Technical analysis and proof-of-concept for CVE-2026-21858, an authentication bypass and RCE in n8n, demonstrating LFI, session forgery, and full…
jakubie07/cve-2026-1731Proof-of-concept exploit for CVE-2026-1731, a blind RCE in BeyondTrust Privileged Remote Access and Remote Support, allowing remote command execution…
hakaioffsec/cve-2026-33725Proof-of-concept exploit for CVE-2026-33725, achieving remote code execution and arbitrary file read via H2 JDBC INIT injection in Metabase…
rockmelodies/cve-2026-23524Laravel Reverb 为 Laravel 应用提供实时 WebSocket 通信后端。在 1.6.3 及更早版本中，Reverb 将来自 Redis 通道的数据直接传递给 PHP 的 unserialize() 函数，且未对可实例化的类进行限制，导致用户面临远程代码执行风险。