splitting-the-email-atom
portswigger/splitting-the-email-atomResearch materials and tooling for exploiting email address parser discrepancies to bypass access controls, including fuzzers, Hackvertor tags, CSS…
ctfeducationemail-security+7
99
portswigger/splitting-the-email-atomResearch materials and tooling for exploiting email address parser discrepancies to bypass access controls, including fuzzers, Hackvertor tags, CSS…
yym8538/cve-2026-40897Proof-of-concept exploit for CVE-2026-40897, a Math.js expression parser sandbox bypass enabling remote code execution via crafted payloads and a…
unh00k3d/cve-2026-85706Root-cause analysis, vulnerable Docker lab, and PoC scripts for CVE-2026-85706, an unauthenticated arbitrary file read in GitLab via a Workhorse/Puma…
toanln-cov/cve-2026-78070SQL Injection via ORDER BY Shortcode in plg_content_dpcalendar — DPCalendar Free ≤ 10.11.2
worthes/cve-2026-30863-exploitCWE-287: Improper Authentication in parse-community parse-server
ser0n-ath/multiparty-cve-2026-8161Proof-of-concept exploit for CVE-2026-8161, a denial-of-service vulnerability in multiparty multipart parser, demonstrating prototype pollution…
elyasbassir/cve-2025-49844Exploit script for CVE-2025-49844, a use-after-free vulnerability in Redis Lua parser, enabling remote code execution on vulnerable Redis servers.
m3terpreter/cve-2016-4437Proof-of-concept exploit for CVE-2016-4437, an Apache Struts2 remote code execution vulnerability. Demonstrates exploitation of the Jakarta Multipart…
graysignal/cve-2024-23897-jenkins-arbitrary-read-file-vulnerabilityUnauthenticated Jenkins CLI exploit scanner for CVE-2024-23897 that detects vulnerable versions and reads arbitrary files from the controller through…
sn0x-sharma/cve-2026-44401Persistent XSS in Typemill CMS: the Markdown parser lets javascript: URIs through unfiltered. Writeup + PoC.
wupco/gitlab-rce-demoSelf-contained demo for GitLab RCE exploiting two Ruby memory corruption bugs in the Oj parser through notebook diff rendering.
4minx/cve-2026-64638CVE-2026-64638 (XSS2shell) POC.
george0papasotiriou/cve-2026-11112-xxe-via-svg-image-uploadDemonstrates XXE via SVG upload with a vulnerable Flask/lxml parser and an exploit script for arbitrary file read, SSRF, and denial-of-service…
george0papasotiriou/cve-2026-21011-log4j-style-jndi-injection-in-custom-logger-simulated-Simulates CVE-2026-21011, a Log4j-style JNDI injection in a custom logger: parses ${jndi:...} patterns and demonstrates LDAP-triggered remote code…
0xdak/cve-2026-69098_exploitUnauthenticated remote code execution exploit targeting insecure YAML deserialization in LLM connection checks; supports arbitrary command execution…
george0papasotiriou/cve-2026-1010-websocket-connection-smuggling-via-malformed-upgrade-headerProof-of-concept exploit for CVE-2026-1010, demonstrating WebSocket connection smuggling and request splitting through a malformed Upgrade header…
george0papasotiriou/cve-2026-2020-ssrf-via-url-parser-differentialDemonstrates SSRF exploitation via URL parser differential between urllib.parse and requests, including vulnerable service and PoC exploit script.
theopaid/cve-2026-67184-unauthenticated-null-pointer-dereference-crashes-the-server-tinyweb-Security Advisory: Unauthenticated NULL Pointer Dereference Crashes the Server (TinyWeb)