Tools

kalhoralireza/cve-2026-17532-lab

Docker lab demonstrating CVE-2026-17532, an unauthenticated reflected XSS in Seraphinite Accelerator that chains to RCE via admin session, with…

abraxas/cve-2026-79752

CVE-2026-79752 disclosure pack for CakePHP 5.2.13 SQL injection via FunctionsBuilder::cast, with a Python PoC script and Docker lab for authorized…

crims-on/cve-2021-21239

A script to exploit a vulnerability in xmlsec1 where xmlsec ignores loaded public keys

certushack/cve-2024-3400-poc

Sets up a Docker-based Palo Alto firewall test environment and provides an exploit script to test CVE-2024-3400, enabling safe vulnerability…

fineman999/poc_cve-2026-35037

Local isolated reproduction lab for CVE-2026-35037, an unauthenticated SSRF vulnerability in Ech0's GET /api/website/title endpoint. Includes Docker…

darryk10/cve-2021-25735

Exploit for CVE-2021-25735 demonstrating Kubernetes Validating Admission Webhook bypass via node label manipulation, with deployable Docker container…

abraxas/cve-2026-45140

Disclosure pack and PoC script for CVE-2026-45140, an unauthenticated path traversal and RCE in Chamilo LMS CStudio upload, with a loopback Docker…

abraxas/cve-2026-87796

Reproduction pack and PoC script for CVE-2026-87796, an unauthenticated arbitrary file upload RCE in Multi Uploader for Gravity Forms <= 1.1.9, with…

dungsocool/cve-2024-23897

Docker-based lab and exploit script for CVE-2024-23897, a critical arbitrary file read in Jenkins CLI via args4j expandAtFiles, with steps to chain…

abraxas/cve-2026-75827

Proof-of-concept and lab for CVE-2026-75827, a Grav arbitrary file write via Blueprint dynamic-data error_log, with reproduction script and Docker…

deepanshu-khurana/cve-2023-43804

Containerized three-tier lab reproducing CVE-2023-43804 urllib3 cookie leak via cross-origin redirects, with exploit script and patch verification.

fimtow/cve-2021-24750

Demonstration of the WP Visitor Statistics plugin exploit

tegal1337/0l4bs

Cross-site scripting labs for web application security enthusiasts

dinosn/cve-2026-3844

Proof-of-concept exploit for CVE-2026-3844, an unauthenticated arbitrary file upload leading to remote code execution in Breeze Cache <= 2.4.4.…

nikeee/cve-2026-27607

Proof-of-concept exploit for CVE-2026-27607, a missing post-policy validation in RustFS, demonstrating the vulnerability with a Node.js script and…

limmmw/cve-2025-54352

Proof-of-concept exploit for CVE-2025-54352, a WordPress vulnerability that leaks titles of private and draft posts. Demonstrates the attack and…

cyberharsh/nginx-cve-2017-7529

PoC exploit for Nginx integer overflow vulnerability (CVE-2017-7529) enabling out-of-bounds cache read. Includes Docker-based lab environment and…