Catálogo de exploits

SessionReaper-CVE-2025-54236

this little script blocks the new splice-ram-privlilleg ecalation fastly befor the contributers do it ( CVE-2026-31431) (CopyFail fix)

First CTF successfully completed! This repo documents my walkthrough of TryHackMe's Simple CTF. It covers network reconnaissance (Nmap), web exploitation (CVE-2019-9053), and credential cracking. As a dev, it was great to pivot from SQLi to a Root shell by leveraging Sudo misconfigurations. Educational purposes only.

Reproduced the fileless LPE CVE‑2026‑31431 (“Copy Fail”) on Kali Linux, then built auditd, Sigma & YARA detections to catch this stealthy kernel exploit that leaves no disk footprint.

CVE-2026-0001. Do with your own risk

pixelotes/lab-cve-2023-4863

🚀 CVE-2026-0073 - Android ADB Wireless Debugging Exploit (CVSS 8.8) 🔓 Zero-click authentication bypass via TLS type confusion. Gain interactive shell, execute commands, scan networks. Educational red-team tool. 🐚⚡

A tiny explanation + PoC for CVE-2026-43284

Checker and fixer for all 13 vulnerabilities in the Next.js May 2026 security release (CVE-2026-23870)

masjadaan/CVE-2025-29338

Bencodin/CVE-2026-23918-poc

There is a path injection vulnerability in OpenPLC-v3, which arises from the program not performing any validity checks on the file path parameters passed in from the command line. Attackers can read any readable file by constructing malicious paths, posing a risk of information leakage.

CVE-2026-41729 PoC

rootdirective-sec/CVE-2026-33626-Lab

Controlled reproduction of CVE-2017-0144 (EternalBlue) in an isolated AWS EC2 lab — exploit analysis, Wireshark traffic capture, and MITRE ATT&CK mapping

Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox

CSRF (Cross-Site Request Forgery) vulnerability in gpEasy 1.5-16.3

exploit for CVE-2026-42945

PoC Exploit for Apache httpd 2.4.49 & 2.4.50 remote code exploitation

sh4den/CVE-2026-31431-copyfail-aarch64

azefzafyoussef/CVE-2026-34621

PoC for CVE-2026-3609 - XIGNCODE3 xhunter1.sys handle leak enabling PPL bypass and LSASS dumping

CVE-2026-41940 cPanel/WHM Auth Bypass Exploit - Best Flow - CRLF injection leads to auth bypass, session hijacking & account leak. Proxy, custom UA, keep-alive, retries, SSL verify, colored output, file save support. Advanced PoC for pentesters. Only Ethical & Safety Uses.

Claude Code skill to scan machines for Mini Shai-Hulud (CVE-2026-45321) supply chain worm IOCs

Dead.Letter CVE-2026-45185 EXIM Vulnerability Detection Script

lamaper/CVE-2026-52200

Cybersecurity demo exploiting CVE-2026-35455 with automatic API key generation and exfiltration

CVE-2023-4220 — Unauthenticated file upload RCE in Chamilo LMS ≤ 1.11.24. OSCP-style and auto exploit.

🛡️ One-command scanner for CVE-2026-45321 — TanStack npm supply-chain attack

Detects CVE-2026-45321 (TanStack supply chain compromise) and Mini Shai-Hulud worm artifacts. Scans node_modules, lockfiles, persistence hooks (Claude Code, VS Code, systemd, LaunchAgent), GitHub workflows, git history, C2 domains, and AI tool configs.