CVE-2026-39987
k3ystr0k3r/cve-2026-39987Proof-of-concept exploit for Marimo pre-authentication RCE. Uses the unauthenticated /terminal/ws WebSocket endpoint to spawn a PTY and establish a…
exploitationpenetration-testingred-teaming+2
k3ystr0k3r/cve-2026-39987Proof-of-concept exploit for Marimo pre-authentication RCE. Uses the unauthenticated /terminal/ws WebSocket endpoint to spawn a PTY and establish a…
wattocyber/offensive-one-liners110 offensive security one-liners for authorized testing and CTFs, organized in one markdown notebook by category and kill-chain step. Dual-use…
zavisco/cve-2026-64849.yamlDetects unauthenticated MLflow webhook SSRF (CVE-2026-64849) that accesses internal or cloud metadata services and leaks response details via…
trandonga3/poc-cve-2026-63030-cve-2026-60137-Exploit chain for WordPress Core using REST API route-confusion and SQL injection for unauthenticated RCE, privilege escalation, and full server…
anirbala98/cve-2026-539594gaBoards < 3.3.9 - User Information Disclosure
renzi25031469/cve-2026-19478Detects CVE-2026-19478 in GitLab CE/EE with a non-destructive Nuclei template that triggers the GraphQL fallback-field method invocation via touch…
ilhomjonr/cve-2026-71518Advisory and PoC for an unauthenticated authorization bypass in Typemill media downloads, using path-equivalent URL variants to access…
davkharrr/cve-2026-19478-pocProof-of-concept exploit for unauthenticated remote code injection in GitLab's GraphQL API, using crafted queries to modify or delete public projects…
graysignal/cve-2024-23897-jenkins-arbitrary-read-file-vulnerabilityUnauthenticated Jenkins CLI exploit scanner for CVE-2024-23897 that detects vulnerable versions and reads arbitrary files from the controller through…
yora1928/cve-2026-15748Scans WordPress Forminator for CVE-2026-15748 unauthenticated RCE. Detects vulnerable sites, crawls forms, extracts nonces, runs safe upload tests.
c00ln3t/log4shellauditorAn autonomous reflective Go agent for full-cycle security auditing, WAF evasion, OOB LDAP verification, self-remediation (auto-patching), and…
cyberauth/cve-2026-20079Implements the CVE-2026-20079 authentication-bypass-to-root-RCE chain against Cisco Secure FMC using fingerprint, check, proof, and interactive…
nel-droid/cve-2026-71205-pocPoC: changedetection.io unlimited login brute-force, no rate limiting (CVE-2026-71205, Medium 6.5)
phanhoangkhang/react2shellIsolated Docker lab and static scanner for CVE-2025-55182, with vulnerable/patched Next.js builds and PoC validation of RSC Flight deserialization.
aleewyy/cve-2025-49132Minimal proof-of-concept exploit for CVE-2025-49132 in Pterodactyl panels; reads PHP files to extract database credentials and enable unauthorized…
minanagehsalalma/zyxel-social-login-bypass-cve-2026-8508Public writeup, PoC, and emulation materials for CVE-2026-8508 affecting Zyxel captive-portal social login.
opaxial/cve-2026-9830Python PoC validating unauthenticated BookingPress Pro REST API exposure and checking for exposed booking/customer data with configurable request…
blacksheepstudio/cve-2017-7921-expPython exploit for CVE-2017-7921 in Hikvision IP cameras, performing unauthenticated user enumeration, snapshot capture, and configuration file…