Catálogo de exploits

Python tool for CVE-2010-1240 research - generates malicious PDFs exploiting Adobe Reader Launch Actions

Shinkirou789/Cve-2025-8088-WinRar-vulnerability

Proof-Of-Concept to check privileges of af_packet.c for validating the privileges acquired by any hacker upon successful exploitation of CVE-2021-22600

PoC for achieving RCE in Langflow versions <1.3.0

CVE-2024-28397 - Remote Code Execution From Vulnerable JS2PY

do not use. vulnerable

Example PoC for CVE-2025-24813 (Tomcat RCE)

A Rust implementation of the CVE-2014-6287 exploit targeting Rejetto HTTP File Server (HFS) versions 2.3x before 2.3c.

2 web apps vulnerable to CVE-2025-27210

PoC for CVE-2025-20265 Cisco Secure FMC Software RADIUS Remote Code Execution Vulnerability

RedArrow3.2 是一款用于渗透测试ThinkPHP 5.0.23 远程命令执行漏洞(CVE-2018-20062)的图形化工具。

CVE-2019-3396 confluence SSTI RCE

0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE

Authentication bypass vulnerability in versions of the CrushFTP server.

tranphuc2005/CVE-2017-9822

tcetin704/CVE-2017-12611

Langflow Remote Code Execution

A proof-of-concept exploit for WinRAR vulnerability (CVE-2025-8088) affecting versions 7.12 and lower. This tool creates a malicious RAR archive that embeds payloads in Alternate Data Streams (ADS) with path traversal, potentially leading to arbitrary code execution.

Documented CVE-2021-41773 (Apache HTTP Server path traversal, CVSS 9.8) — produced CVSS breakdown, impact assessment, and a mitigation plan (patch to 2.4.51+, CGI disable, firewall) and published the analysis on GitHub.

Safe, read-only SQL Injection checker for FreePBX (CVE-2025-57819), using error/boolean/time-based techniques with per-parameter verdicts and JSON reporting.

shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3_2_1_fixed

Shubhankargupta691/CVE-2024-42009

chin-tech/CrushFTP_CVE-2025-54309

Grafana SQL Expressions → DuckDB LFI (CVE-2024-9264)

CVE-2025-48384-submodule

Hands-on pentest project using Kali Linux vs Metasploitable2. Includes full workflow: Nmap scanning, enumeration, Metasploit exploitation (Samba CVE-2007-2447), post-exploitation validation, and mitigation steps. Repo contains commands, outputs, and report showing both offensive techniques and defensive recommendations.

Python PoC script for pgAdmin4 Query Tool RCE (CVE-2025-2945)

GIT vulnerability | Carriage Return and RCE on cloning

CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.

FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied data in endpoints.