Tools

jimmexploit/cve-2026-42167-poc

Functional SQL injection exploit for CVE-2026-42167 in ProFTPD mod_sql, enabling unauthenticated attackers to inject commands via USER parameter.…

renniepak/cspbypass

CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting)…

cerberusmrxi/cerberus-react2shell-scanner-exploit

Elite exploitation toolkit for CVE-2025-55182 (React Server Components RCE). Async polymorphic payloads, advanced WAF/CDN bypass, proxy rotation,…

iamdremig/cve-2026-65591

PoC exploit for a sanitizer bypass in n8n legacy expression evaluator leading to host-level code execution by authenticated workflow creators.

mrcl0wnlab/nuclei-template-exploit-f5-big-ip-icontrol-rest-auth-bypass-rce-command-parameter

CVE-2022-1388 is an authentication bypass vulnerability in the REST component of BIG-IP’s iControl API that was assigned a CVSSv3 score of…

sevagas/macro_pack

macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for…

ap0dexme0/cve-2023-2732

Perform With Massive Authentication Bypass (Wordpress Mstore-API)

mauro-g/snuck

Automatic XSS filter bypass

synacktiv/cve-2024-45409

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit

sachinart/cve-2024-0012-poc

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) RCE POC

portbuster1337/cve-2026-27771

CVE-2026-27771 - Gitea/Forgejo Container Registry Auth Bypass Exploit PoC - Pull private container images without authentication

offseckit/cve-2026-23813

CVE-2026-23813 — AOS-CX pre-auth bypass via nginx regex. Detection script, bypass demo, config-disclosure PoC, and IDS rules.

ne0zer01/cve-2024-27198_lab

Docker-based lab for CVE-2024-27198 TeamCity authentication bypass. Includes exploit reproduction, IoC hunting with Sigma/Suricata rules, and…

whisperer1290/cve-2025-54309__enhanced_exploit

Multi-threaded exploit for CrushFTP authentication bypass (CVE-2025-54309) with race condition implementation, XML payload generation, and admin user…

yiliufeng168/cve-2022-31813

Demonstrates CVE-2022-31813 Apache HTTP Server bypass using X-Real-IP header manipulation to evade access controls, with a Docker-based test…

mbadanoiu/cve-2022-24442

CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack

dagowda/zabbix-cve-2022-23131-sso-bypass

Exploit script for CVE-2022-23131 that bypasses Zabbix SSO authentication by forging JWT tokens, enabling unauthorized admin access to the monitoring…

mbadanoiu/cve-2022-40634

CVE-2022-40634: FreeMarker Server-Side Template Injection in CrafterCMS