Exploit catalog

Playing with CVE-2010-2883

ay 09 — CVE-2025-27520 (BentoML-style insecure deserialization) — Local Docker lab

Complete analysis of CVE-2025-21298, a double free vulnerability related to ole32 library in windows.

Take first steps in CodeQL for Python by writing a query to find CVE-2024-32022

PoC and exploit scripts for CVE-2023-20048 - Remote Code Execution vulnerability affecting Cisco RV series routers. Includes a vulnerability checker (PoC) and a working exploit for gaining remote shell access. For educational and research purposes only.

A Rust implementation of the CVE-2018-7600 exploit targeting vulnerable Drupal 7 installations (<= 7.57)

iteride/CVE-2025-29927

A working (at least for me :] ) exploit for CVE-2025-25257

CVE-2020-0796 (SMBGhost) is a critical RCE vulnerability in Windows 10 SMBv3 protocol. It allows attackers to execute code remotely via crafted SMB packets, making it wormable. Affects Windows 10 v1903/v1909 and Server 2019. Exploit targets srv2.sys via buffer overflow

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.

CVE-2018-13379 - Fortinet SSL VPN Vulnerability

Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (CVE-2025-34152)

sdrtba/CVE-2025-29927

Detection for CVE-2025-10035

This is a minimal, educational simulation that demonstrates the _impact_ class of a management-plane parsing RCE (inspired by CVE-2025-20265). It intentionally executes commands from crafted input for local learning only.

🔍 Demonstrate the CVE-2025-32463 privilege-escalation flaw in sudo's chroot feature with this minimal, reproducible proof of concept environment.

pucagit/CVE-2025-9074

A lightweight utility designed to detect and remediate systems affected by CVE-2024-3094, a critical vulnerability impacting [insert affected software/library here if known]. This tool provides automated scanning, reporting, and optional mitigation steps to help administrators and security teams secure their environments quickly.

Google patched CVE-2025-10585, a Chrome V8 zero-day under active exploitation — here’s what it is, why it matters, and how to stay safe.

CVE-2025-49113 - Roundcube Remote Code Execution

WinRAR漏洞CVE-2025-8088的payload一键生成工具

Exploit Path Traversal in esm-dev

HK4zCzi/CVE-2019-3396-Velocity-Server-Side-Template-Injection

There are Exploit for Magnus Billing v7 system get root privilages

test

This repository includes two PoC scripts for CVE-2025-57819 in FreePBX: one to create a new admin user (poc_admin.py), and another to extract credentials using sqlmap (poc_auto_get_username_pass.py). For educational and authorized use only.

This tiny lab simulates the core idea behind CVE-2025-29306: unsafe use of `unserialize()` on attacker-controlled input leading to remote code execution.

veniversum/cve-2025-43300

A hands-on forensic walkthrough of CVE-2025-59359, a critical OS command injection flaw in Chaos-Mesh. Learn how attackers hijack Kubernetes clusters via GraphQL mutations, and how to detect, analyze, and report the breach using ELK.

Shinkirou789/Cve-2025-8088-WinRar-vulnerability