rapid7/metasploit-frameworkOpen-source exploitation framework with modular payload, encoder, and auxiliary system for penetration testing, vulnerability validation, and…
reajason/memshellparty一款专注于 Java 主流 Web 中间件的内存马快速生成工具，致力于简化安全研究人员和红队成员的工作流程，提升攻防效率
leebaird/discoverCustom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload…
defineid/palimpsestCVE-2026-74945 · Uninitialized heap disclosure via a crafted web font (sec-high)
absholi7ly/elementor-pro-unauthenticated-arbitrary-file-upload-to-rceCVE-2026-32475 The Elementor Pro Forms File Upload field handles validation and file processing in two separate loops with different handling of…
cenobyte-vincit/slot2UEFI GRUB2 bootkit that installs a pre-boot networked implant via NVRAM boot option, chainloads a UKI, executes a dracut payload, and kexecs the…
1ndevelopment/cve-2026-43499-s26Exploits CVE-2026-43499 on Android GKI 6.12 devices: deterministic arbitrary kernel read/write, KASLR bypass, and full root via LD_PRELOAD payload.
not-sekiun/pyirisPyIris is a modular remote access trojan toolkit written in python targeting Windows and Linux systems.
typedefabcd1234ntd/cve-2026-19501-pocProof-of-concept for unauthenticated CSV formula injection in SureForms, showing crafted form submissions trigger spreadsheet formulas when exported…
kaandemir993/dropper-gcleaner-c2-infrastructure-kernel-driver-powershell-conhost-payload-analysisReverse engineering analysis of Dropper GCleaner, a malware that uses a resilient C2 infrastructure, kernel driver loading, PowerShell/Conhost…
realstatus/cve-2026-47858Proof-of-concept exploit for unauthenticated JMX RCE in Spring Tools live information mode, using MLet remote class loading to execute arbitrary…
alyaapm/cve-2025-55182-shellinteractiveInteractive shell for exploiting CVE-2025-55182 in React Server Components, enabling remote command execution, file transfer, and vulnerability…
superman-l/cve-2026-16723Reproduces fastjson 1.2.83 @JSONType RCE with a vulnerable Spring Boot target and ASM-based payload generator using HTTP or file protocol jar chains.
cypherhippie/cve-2026-34486---unauthenticated-rce-via-java-deserializationEncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization.
liaomilk/cve-2025-69212-for-myselfjust record for myself
katransefa/cve-2026-13714Unauthenticated RCE exploit for Realtyna WPL < 5.3.0 that uploads a PHP webshell via hardcoded API key and executes arbitrary system commands.
omribaso/sccm-cve-2026-47301-remote-code-execution-exploitProof-of-concept exploit chain (CVE-2026-47301) for Microsoft Configuration Manager (SCCM), combining a broken access, CAB arbitrary-write path…
