-CVE-2026-1657
vimashdilshara/-cve-2026-1657Exploit for CVE-2026-1657, an unauthenticated image upload vulnerability via the 'ep_upload_file_media' AJAX endpoint, allowing remote file upload.
exploitationpenetration-testingvulnerability-scanners+2
vimashdilshara/-cve-2026-1657Exploit for CVE-2026-1657, an unauthenticated image upload vulnerability via the 'ep_upload_file_media' AJAX endpoint, allowing remote file upload.
jvr2022/cve-2026-23745Proof-of-concept exploit for CVE-2026-23745, a path traversal vulnerability in node-tar allowing arbitrary file overwrite via malicious tar archives.
murrez/cve-2026-0911Authenticated PoC for CVE-2026-0911: tests weak file upload and orphan file behavior in WordPress Hustle plugin's module import endpoint, with…
xn2/cve-2023-46474Technical write-up and proof-of-concept for CVE-2023-46474, a remote code execution vulnerability in PMB <=7.5.3 via unrestricted file upload,…
firebasky/cve-2026-39363Exploit for CVE-2026-39363, a Vite Dev Server WebSocket arbitrary file read vulnerability, with Python and Node.js scripts for automated exploitation…
beefproject/beefThe Browser Exploitation Framework Project
rxerium/freepbx-vulns-december-25Detection for CVE-2025-61675, CVE-2025-61678 & CVE-2025-66039
permanet/permanetCryptographically verifiable web archiving. Playwright capture → SHA-256 Merkle hash → Bitcoin-anchored OpenTimestamps → permanent Arweave storage.
syfi/panaceasoft-0day-exploitPanaceaSoft [all products] 0day exploit
nel-droid/cve-2026-71205-pocPoC: changedetection.io unlimited login brute-force, no rate limiting (CVE-2026-71205, Medium 6.5)
nel-droid/cve-2026-71206-pocPoC: Shiori JWT CheckToken never re-validates account state (CVE-2026-71206, High 8.2)
josephfarah-ciso/cve-2026-9999-exploitProof-of-concept and GLSL fuzzer for CVE-2026-9999 in Chrome's ANGLE/Metal WebGL backend, with build fingerprinting, curated shaders, and crash…
9xh4kv/cve-2025-8110PoC for CVE-2025-8110: Authenticated RCE in Gogs via symlink bypass in PutContents API
4minx/cve-2026-64638CVE-2026-64638 (XSS2shell) POC.
polosss/by-poloss..-..cve-2026-9067Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload [POC & Xploit]
0xblackash/cve-2025-68645CVE-2025-68645
sijiahi/wordpress_cve-2019-9787_defenseThis is a recurrence of cve-2019-9787 on Wordpress and a hash-based defense.
kai-one001/wordpress-news-and-blog-designer-bundle-cve-2025-14502WordPress的News and Blog Designer Bundle插件在1.1及之前所有版本中，存在通过template参数导致的本地文件包含漏洞。该漏洞使得未经身份验证的攻击者能够包含并执行服务器上的任意.php文件，从而运行这些文件中的任何PHP代码。在允许上传和包含.php文件类型…