Exploit catalog

CVE-2021-34527 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare."

Exploitation and Post-Exploitation Multitool for Palo Alto PAN-OS Systems affected by vulnerabilities CVE-2024-0012 and CVE-2024-9474

initial-access

initial-access

HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI)

It was determined that malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. # It was determined that only certain operating systems and operating system versions were affected by this vulnerability.

PoC for CVE-2025-47646 - WordPress PSW Front-end Login Registration Plugin ≤ 1.12 Unauthenticated Privilege Escalation

PoC and vulnerability report for CVE-2025-47827.

CVE-2024-53677

IndominusRexes/CVE-2025-4322-Exploit

client-side

client-side

infoleak

Automated path traversal testing tool for Grafana plugin endpoints using curl and Bash.

The `swp_debug` parameter in `admin-post.php` allows remote attackers to include external files containing malicious PHP code, which are evaluated on the server. By supplying a crafted URL that hosts a reverse shell payload, an attacker can gain command execution.

Vulnerabilidad NTLM (CVE-2025-24054) explotada para robo de hashes

Um script automatizado melhorando o exploit do cve-2011-0762 postado no exploit-db

Designed for Demonstration of Deep Exploitation.

Mitel MiCollab Authentication Bypass to Arbitrary File Read

Invision Community 5.0.6 - Remote Code Execution (RCE)

CrushFTP 11.3.1 - Authentication Bypass

Zyxel USG FLEX H series uOS 1.31 - Privilege Escalation

local

initial-access

infoleak

tdevworks/CVE-2020-1472-ZeroLogon-Demo-Detection-Mitigation

tdevworks/CVE-2020-0796-SMBGhost-Exploit-Demo

CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation (CVE-2025-31201), and allowed token theft until patched in iOS 18.4.1 (Apr 16, 2025).

Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation

Automation Exploit