Catálogo de exploits

Cockpit: Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection

Implements the mitigation for CVE-2025-54505 as described by AMD-SB-7053

marimo is a reactive Python notebook. Prior to 0.23.0, Marimo has a Pre-Auth RCE vulnerability

CVE-2026-22241

CVE-2021-25337

Samba CVE-2007-2447 Exploit

coolkiee/CVE-2019-9053

yutasato88/CVE-2021-3560-PolkitPrivilegeEsclation

Exploiting bluekeep (CVE-2019-0708)on windows 7 using metasploit (Educational lab)

Exploiting BlueKeep (CVE-2019-0708) on Windows 7 using Metasploit

CVE-2025-8110 Specifically for the Silentium box on HTB.

Published Details for this CVE

CVE-2026-26980 — Ghost CMS Content API SQL Injection Lab (unauthenticated blind SQLi via slug filter ordering)

Escalating privilege in the system from unsigned driver using throttlestop vulnerability

Escaner de identificacion de vulnerabilidades para CVE-2025-4322

Ninja Forms File Uploads <= 3.3.26 - Unauthenticated Arbitrary File Upload

Exploiting bluekeep (CVE-2019-0708) on windows 7 using metasplotable

CVE-2026-3891 Mass Scanning

CVE-2025-49113 – Roundcube ≤1.6.10 post-auth RCE via PHP object deserialization (HackTheBox CTF)

Investigation of a PAN-OS CVE-2024-3400 command injection attempt, analyzing payload delivery, internal processing, and execution validation based on log evidence.

CVE-2025-24893 – XWiki SSTI unauthenticated RCE exploit (HackTheBox CTF)

Saku0512/CVE-2026-40176-poc

ZaidArif47/CVE-2024-42009

CVE-2010-2075 exploit

A critical access control vulnerability in locally deployed Pro-Bit application in versions less than v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories.

Secured root-level access by identifying and exploiting misconfigurations and outdated software. Buffer overflow vulnerability in an outdated version of mod_ssl (CVE-2002-0082). Privilege escalation was subsequently achieved by exploiting a race condition in the Linux kernel's "ptrace" utility (CVE-2003-0127),

Fixed CVE-2019-9053

Secured root-level access by identifying and exploiting misconfigurations and outdated software. Buffer overflow vulnerability in an outdated version of mod_ssl (CVE-2002-0082). Privilege escalation was subsequently achieved by exploiting a race condition in the Linux kernel's "ptrace" utility (CVE-2003-0127),

A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool. That is also used in HTB seasonal challenge. The issue is present in version <= 3.0.5, for more details: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p

Authenticated Remote Code Execution (RCE) exploit for Flowise AI versions ≤ 3.0.4. Leverages a vulnerability in the /api/v1/node-load-method/customMCP endpoint to execute arbitrary system commands via Node.js child_process.execSync(). Includes full PoC script and remediation steps.