Catálogo de exploits

nguyentranbaotran/cve-2025-48384-poc

krypton-0x00/CVE-2025-32463-Chwoot-POC

rpc.py 0.6.0 - Remote Code Execution (RCE)

Kalidas-7/CVE-2019-9053

malaya-m/cve-2013-3900-remediation-report

Floodnut/CVE-2025-32463

ECHO6789/CVE-2025-48384-submodule

PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated.

CVE-2025-5777 (CitrixBleed 2) - [Citrix NetScaler ADC] [Citrix Gateway]

An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 (CitrixBleed 2). This script not only identifies the vulnerability but also helps in demonstrating its impact by parsing human-readable information from the memory leak.

Armand2002/Exploit-CVE-2025-1974-Lab

CVE-2025-29927 PoC | Auth Bypass Exploit | Python Tool using httpx | Middleware Vulnerability | Ethical Hacking Toolkit

mheranco/CVE-2025-44136

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

This repository contains a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability affecting vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 when running on PHP 8.1 or later. The vulnerability allows unauthenticated attackers to invoke protected API methods remotely.

Privilege escalation to root using sudo chroot, NO NEED for gcc installed.

This repository includes the code and files needed to test and execute a PoC for CVE-2025-41656

Royal Elementor Addons - Unauthenticated Remote Code Execution

JayVillain/Scan-CVE-2025-6058

CVE-2020-35848 impacts Cockpit-CMS v1.7 due to unsafe handling of user inputs in authentication mechanisms, leading to remote code execution. This lab is built for CTF players and bug bounty learners to simulate real-world exploitation workflows including token extraction, password reset, and flag capture.

CVE-2025-32023

🚀 Exploit for Moodle 4.4.0 Authenticated RCE (CVE-2024-43425) — run commands remotely ⚡

This is a security assessment report regarding the EthernalBlue vulnerability (CVE-2017-0143).

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

A detailed walkthrough of TryHackMe's Billing room exploiting CVE-2023-30258 and escalating via fail2ban misconfig

Wazuh 8.4 CVE-2025-24016

Tool for detecting and exploiting CVE-2025-25257 in Fortinet FortiWeb.

Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.

r0otk3r/CVE-2024-1212

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution