Tools

pentestmano/cve-2023-24329-exploit

Proof-of-concept demonstrating a URL parsing bypass in Python's urllib.parse (CVE-2023-24329) that allows bypassing blocklists by prepending spaces.

wooluo/cve-2022-25581

Python exploit script for CVE-2022-25581 (ClassCMS 2.4 arbitrary file download) that automates login, CSRF token extraction, malicious zip upload…

itssixtyn3in/cve-2023-42222

Proof-of-concept exploit for CVE-2023-42222 in WebCatalog, demonstrating arbitrary URL execution via Electron's shell.openExternal to bypass security…

creacitysec/cve-2023-49103

Multi-threaded Python PoC scanner for CVE-2023-49103 that checks large URL lists for exposed phpinfo() output with .htaccess bypass via /.css path…

ilhomjonr/cve-2026-71518

Advisory and PoC for an unauthenticated authorization bypass in Typemill media downloads, using path-equivalent URL variants to access…

mbadanoiu/cve-2023-40037

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi

amitlttwo/cve-2022-1388

Python-based exploit for CVE-2022-1388, an F5 BIG-IP iControl REST authentication bypass leading to remote code execution. Supports single URL,…

anmolksachan/cve-2020-2733

Exploit for CVE-2020-2733 in JD Edwards EnterpriseOne Tools, demonstrating unauthenticated admin password decryption and authentication bypass to…

john-jung/cve-2026-25604-poc

A PoC for demonstrating CVE-2026-25604

sashka3076/f5-big-ip-exploit

CVE-2022-1388

henry4e36/cve-2022-1388

F5 BIG-IP iControl REST身份验证绕过漏洞

george0papasotiriou/cve-2026-4444-jwt-algorithm-confusion-via-kid-injection

POC for CVE-2026-4444 demonstrating JWT algorithm confusion via untrusted kid injection, including vulnerable Node.js server and Python exploit for…

henry4e36/cve-2022-33174

Powertek PDU身份绕过

joapath/cve-2021-42013

Proof-of-concept exploit for CVE-2021-42013, demonstrating path traversal and remote code execution on Apache 2.4.50 via double URL encoding bypass…

bl4ck574r/cve-2019-17662

Exploit for CVE-2019-17662, a path traversal vulnerability in ThinVNC, demonstrating URL normalization bypass to access arbitrary files on the target…

cyberharsh/drupalcve-2018-7602

Exploit for Drupal CVE-2018-7602 remote code execution vulnerability via double URL encoding bypass of sanitize() filter. Includes Docker-based lab…

shiomiyan/cve-2023-41080

Proof-of-concept exploit for CVE-2023-41080, demonstrating URL validation bypass in Apache Tomcat to redirect users to arbitrary external sites via…

zephyr1ng/cve-2025-60423

Analyzes CVE-2025-60423, an authentication bypass in JEECG versions 7.2.8 and 7.2.9, detailing path traversal and URL encoding techniques to bypass…