Tools

kgretzky/evilqr

Proof-of-concept to demonstrate dynamic QR swap phishing attacks in practice.

0neb1n/cve-2020-16947

PoC of CVE-2020-16947 (Microsoft Outlook RCE vulnerablility)

srvaccount/cve-2021-26855-poc

PoC exploit code for CVE-2021-26855

arjunindia/fb-phisher-python

A python server tool based on flask , this tool can phish some Facebook credentials!

je6k/cve-2021-34473-exchange-proxyshell

对Exchange Proxyshell 做了二次修改，精确的拆分、实现辅助性安全测试。

horizon3ai/ivanti-epm-coercion-vulnerabilities

Proof of concept exploit for Ivanti EPM CVE-2024-13159 and others

demossl/cve-2021-33766-proxytoken

CVE-2021-33766-poc

h4k6/cve-2023-2982-poc

WordPress社交登录和注册（Discord，Google，Twitter，LinkedIn）<=7.6.4-绕过身份验证

dungsocool/cve-2026-64638

Proof-of-concept exploit for CVE-2026-64638: reflected XSS in WordPress login chained with DOM clobbering to achieve admin account takeover and…

ashwesker/ashwesker-cve-2025-68645

POC BLH Magelang CSIRT 2026 by babyrootkid

tc4dy/cve-2026-6875-poc-exploit

CVE-2026-6875 ServiceNow Pre-Auth RCE Framework 🔥 JS Injection → Sandbox Escape → RCE → Root. Features: --detect, --exec, reverse/interactive shell,…

eeenvik1/cve-2023-51764

PoC CVE-2023-51764

afine-com/cve-2018-25031

.json and .yaml files used to exploit CVE-2018-25031

g33xter/cve-2021-28079

POC Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An…

weswrench/cve-2026-36214

Stored Cross-Site Scripting (XSS) in osTicket via Vulnerable Bootstrap Tooltip Component

v35hr4j/cve-2022-1597

The plugin, used as a companion for the Discy and Himer themes, does not sanitise and escape a parameter on its reset password form which makes it…