Tools

xmyronn/cve-2026-7028-sqli

Proof-of-concept exploit for SQL injection in CodeAstro Online Job Portal allowing authenticated deletion of all job records via crafted GET request.

nawed20002/cve-2023-30092

Proof-of-concept exploit for SQL injection in Sourcecodester Online Pizza Ordering System 1.0. Demonstrates remote code execution and denial of…

dievus/cve-2021-37833

Proof-of-concept for a reflected cross-site scripting (XSS) vulnerability in Hotel Druid 3.0.2, demonstrating arbitrary JavaScript execution via…

ivanesk315/cve-2026-42613

PHP proof-of-concept for CVE-2026-42613, demonstrating exploitation of the referenced vulnerability.

drone789/cve-2012-1823

Automated exploit for CVE-2012-1823, a PHP CGI remote code execution vulnerability. Provides a quick check script for vulnerable servers.

bombobombone/cve-2026-103442

Local proof-of-concept and sanitized report for CVE-2026-103442, a PHP object injection in MediaWiki CentralAuth's merge-session handling that can…

zalehack/joomla_rce_cve-2015-8562

All versions of the Joomla! below 3.4.6 are known to be vulnerable. But exploitation is possible with PHP versions below 5.5.29, 5.6.13 and below 5.5.

d0rb/cve-2024-4439

Exploit code for CVE-2024-4439, an unauthenticated stored XSS vulnerability in WordPress Core up to 6.5.1, enabling arbitrary PHP command execution…

0xterror/cve-2026-81780-hash-form

Exploit for CVE-2026-81780: unauthenticated file upload in WordPress Hash Form plugin leading to remote code execution via crafted PHP payloads.

sangsenimanwartefak/cve-2025-6440

Exploit for CVE-2025-6440: unauthenticated arbitrary file upload in WooCommerce Designer Pro WordPress plugin, enabling RCE via malicious PHP upload.

mheranco/cve-2025-44136

Proof-of-concept exploit for unauthenticated reflected XSS in MapTiler Tileserver-php v2.0 via the 'layer' GET parameter, enabling arbitrary HTML/JS…

xmyronn/cve-2026-7089-xss

Proof-of-concept for CVE-2026-7089, a stored XSS in Home Service System PHP 1.0 allowing unauthenticated admin session hijacking via booking form.

xmyronn/cve-2026-6184-stored-xss

Proof-of-concept for a stored XSS vulnerability in Simple Content Management System PHP, demonstrating session cookie theft via unsanitized News…

ianxtianxt/vbulletin-5.x-0day-pre-auth-rce-exploit

Pre-authentication remote code execution exploit for vBulletin 5.x (versions 5.0.0 to 5.5.4). Provides a shell via widget_php widget. Use for…

mbadanoiu/cve-2020-12640

CVE-2020-12640: Local PHP File Inclusion via "Plugin Value" in Roundcube Webmail

ersinerenler/cve-2023-46015-code-projects-blood-bank-1.0-reflected-cross-site-scripting-vulnerability

Proof-of-concept exploit for reflected cross-site scripting (XSS) in Code-Projects Blood Bank V1.0 via the 'msg' parameter in index.php, with payload…

chandraprarikraj/cve-2023-50596

Proof-of-concept for CVE-2023-50596: a stored XSS vulnerability in Simple Image Stack Website (PHP/API v1.0) triggered via a crafted URL payload.