Exploit catalog

FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied data in endpoints.

CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.

Grafana CVE-2025-4123-POC

exploit of CVE-2022-0847 which directly remove password of the root account

Detection for CVE-2025-42944

In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies.

For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.

A hands-on simulation of CVE-2017-5638 (Apache Struts2 RCE), showcasing exploit reproduction, OS-level command execution, and mitigations such as input sanitization and endpoint monitoring. Built in Python/Flask with Jupyter notebook demos

This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.

CVE‑2025‑42957 exposes an RFC‑enabled SAP S/4HANA module that lets low‑privileged users inject ABAP code to create admin accounts and gain full control. The article explains the vulnerability, threat model, provides minimal exploit ABAP code, and lists patching & monitoring steps to secure the system

Advanced network penetration testing toolkit with SSH vulnerability assessment, CVE-2018-15473 exploitation, stealth brute force capabilities, and fail2ban evasion techniques. Professional-grade security testing framework for authorized penetration testing engagements.

To check for vulnerability CVE-2019-13272

CVE-2025-24893 RCE exploit for XWiki with reverse shell capability

Linux privilege escalation using Dirty COW exploit (CVE-2016-5195).

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

Nexus Repository 3 Path Traversal (CVE-2024-4956)

Jenkins CLI arbitrary file read (CVE-2024-23897)

PoC CVE-2025-31161 - Authentication Bypass CrushFTP

Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-

Log4Shell CVE-2021-44228 PoC

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption

PoC Script for the CVE-2018-11776 vuln

This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).

In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host

FuelCMS 1.4.1 Command Injection/Remote Code Execution.

This repository contains the corrected code for CVE: 2019-9053

script de enumeración de usuarios SSH basado en diferencias de timing y respuestas de autenticación. Explota el mismo vector que CVE-2018-15473 en versiones vulnerables de OpenSSH (≤ 7.7), aunque también puede revelar patrones en configuraciones modernas.

boriitoo/CVE-2012-2982

CVE-2025-47812

CVE-2024-6387