Exploit catalog

ECHO6789/CVE-2025-48384-submodule

PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated.

Privilege escalation to root using sudo chroot, NO NEED for gcc installed.

This repository contains a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability affecting vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 when running on PHP 8.1 or later. The vulnerability allows unauthenticated attackers to invoke protected API methods remotely.

mheranco/CVE-2025-44136

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

CVE-2025-29927 PoC | Auth Bypass Exploit | Python Tool using httpx | Middleware Vulnerability | Ethical Hacking Toolkit

Armand2002/Exploit-CVE-2025-1974-Lab

Royal Elementor Addons - Unauthenticated Remote Code Execution

This repository includes the code and files needed to test and execute a PoC for CVE-2025-41656

Wazuh 8.4 CVE-2025-24016

A detailed walkthrough of TryHackMe's Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig

🚀 Exploit for Moodle 4.4.0 Authenticated RCE (CVE-2024-43425) — run commands remotely ⚡

CVE-2025-32023

CVE-2020-35848 impacts Cockpit-CMS v1.7 due to unsafe handling of user inputs in authentication mechanisms, leading to remote code execution. This lab is built for CTF players and bug bounty learners to simulate real-world exploitation workflows including token extraction, password reset, and flag capture.

This is a security assessment report regarding the EthernalBlue vulnerability (CVE-2017-0143).

JayVillain/Scan-CVE-2025-6058

A detailed walkthrough of Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Tool for detecting and exploiting CVE-2025-25257 in Fortinet FortiWeb.

WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload

imbas007/CVE-2025-25257

Proof of Concept for CVE-2025-24813, a Remote Code Execution vulnerability in Apache Tomcat. This PoC exploits unsafe deserialization via crafted session files uploaded through HTTP PUT requests, allowing attackers to execute arbitrary code remotely on vulnerable Tomcat servers.

pkblanks/Remediating-CVE-2013-3900-EnableCertPaddingCheck-

Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

r0otk3r/CVE-2022-1388

r0otk3r/CVE-2024-1212

MacUchegit/Detecting-and-Analyzing-CVE-2024-24919-Exploitation

Metasploit module for MailEnable CVE-2022-36934 authentication bypass RCE