Exploit catalog

Code to decrypt Huawei passwords CVE-2012-4960

In this challenge, I analyzed the Spring4Shell (CVE-2022-22965) vulnerability, investigated security bypasses, and wrote an Incident Postmortem Report detailing the detection, impact, and resolution of the attack. I also implemented a firewall rule in Python to block malicious requests and prevent future exploitation.

User Profile Builder <= 3.11.7 - Unauthenticated Media Upload

CVE-2024-56901 - A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASManager web application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Admin accounts via a crafted POST request.

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

CVE-2017-8869 - MediaCoder 0.8.48.5888 - Local Buffer Overflow (SEH)

CVE-2024-56898 - Broken access control vulnerability in GeoVision GV-ASManager web application with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts.

rehan6658/CVE-2023-40028

CVE-2024-56902 - Information disclosure vulnerability in GeoVision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.

This code is taken from "Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)" and was converted to Python 3 to suit the exercise in Academy for Module "Attacking Commoon Applications" and section "Attacking Drupal".

This repository contains a Proof-of-Concept for the CVE-2021-41773. This CVE contains a LFI and RCE vulnerablity.

hashdr1ft/SOC274-Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400

dorattias/CVE-2025-26319

asepsaepdin/CVE-2021-42013

CVE-2024-8381: A SpiderMonkey Interpreter Type Confusion Bug.

Proof of Concept for CVE-2022-45460

An XNU kernel race condition bug

## About The script has been made for exploiting the Laravel RCE (CVE-2021-3129) vulnerability.<br> This script allows you to write/execute commands on a website running <b>Laravel <= v8.4.2</b>, that has "APP_DEBUG" set to "true" in its ".env" file.

honeyb33z/cve-2020-11023-scanner

asepsaepdin/CVE-2022-33891

asepsaepdin/CVE-2023-32315

lukwagoasuman/-home-lukewago-Downloads-CVE-2021-23017-Nginx-1.14

asepsaepdin/CVE-2022-36804

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

A comprehensive all-in-one Python-based Proof of Concept script to discover and exploit a critical authentication bypass vulnerability (CVE-2024-55591) in certain Fortinet devices.

bsec404/CVE-2020-0796

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248

Ivanti Connect Secure, Policy Secure & ZTA Gateways - CVE-2025-0282

针对JWT渗透开发的漏洞验证/密钥爆破工具，针对CVE-2015-9235/空白密钥/未验证签名攻击/CVE-2016-10555/CVE-2018-0114/CVE-2020-28042的结果生成用于FUZZ，也可使用字典/字符枚举(包括JJWT)的方式进行爆破(JWT Crack)