CVE-2026-3304
mkway/cve-2026-3304Reproduction lab for CVE-2026-3304, a Multer async fileFilter race condition causing disk exhaustion via orphaned temp files. Includes vulnerable and…
educationexploitationlabs-practice+2
mkway/cve-2026-3304Reproduction lab for CVE-2026-3304, a Multer async fileFilter race condition causing disk exhaustion via orphaned temp files. Includes vulnerable and…
sivaadityacoder/cve-2025-68621Educational PoC and analysis of CVE-2025-68621, a timing attack on Trilium Notes sync login. Demonstrates HMAC hash recovery via network timing…
quantumworld-dpdns-io/cve-2026-42945Full CVE-2026-42945 research repository with heap buffer overflow analysis, RCE exploit (heap spray + Feng Shui), detection scripts, and patching…
syn-4ck/wvctfWVCTF or WebVulnCTF is a gamified web platform which promotes training in pentesting and web application development security in an entertaining way.…
lagathos/cve-2026-25594Stored XSS proof-of-concept for InvoicePlane 1.7.0 via the family name field, including payload, request, and impact analysis for defensive research.
turkios/cve-2026-41177-squidex-cmsCVE-2026-41177, a Blind SSRF vulnerability in Squidex CMS (prior to v7.23.0). Includes root cause analysis, reproduction steps, and impact assessment…
pierfrancescoconti/leaflet-cve-2025-69993Proof-of-concept for CVE-2025-69993: Cross-Site Scripting in Leaflet's bindPopup() method. Includes advisory, impact analysis, and a demo Angular…
open-flaw/cve-2017-11499Documentation of CVE-2017-11499: a hash flooding remote DoS vulnerability in Node.js caused by constant HashTable seeds, with analysis of the attack…
sahiloj/cve-2023-37596CVE-2023-37596 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in Issabel PBX version 4.0.0-6, a widely used open-source Unified…
francesco-cyberintelligence/bug-bounty-findings-o-research-disclosures.Bug Bounty: CVE-2023-50839 IDOR identified in a third-party support component via 'gau' and 'Nuclei'. Despite perimeter redirects, the outdated…
menevarad007/cve-2026-37750Reflected XSS proof-of-concept for School Management System 1.0, demonstrating unauthenticated JavaScript execution via the type parameter in…
suil12/cve-2025-24813_presentationPresentation detailing CVE-2025-24813, covering vulnerability analysis, exploitation techniques, and web security implications for educational and…
sreeram281997/cve-2022-21668-pipenv-rce-vulnerabilityDetailed analysis of CVE-2022-21668, a critical RCE vulnerability in Pipenv's requirements.txt parsing, including bug code, exploit mechanics, and…
dinosn/cve-2026-6379Docker-based lab kit for CVE-2026-6379, an unauthenticated SQL injection in WP Photo Album Plus. Includes time-based blind PoC, root-cause analysis,…
sandblastx/flask-vuln-baselineDemonstrates CVE-2024-34064 in a Flask application without sanitization, serving as a baseline for security testing and educational analysis.
rootdirective-sec/cve-2026-27541-analysis-labDocker lab for reproducing CVE-2026-27541, an authenticated privilege escalation in WooCommerce Wholesale Prices. Compares vulnerable and patched…
the-cyber-ledger/tcl-xss-labsAn interactive, self-hosted XSS training platform with 33 progressively harder challenges
pl4tyz/cve-2026-33701-unsafe-deserialization-in-opentelemetry-java-agent-rmi-instrumentationTechnical analysis of CVE-2026-33701, an unsafe deserialization vulnerability in OpenTelemetry Java Agent RMI instrumentation, including exploit…