Catálogo de exploits

Proof of Concept for CVE-2025-32756 - A critical stack-based buffer overflow vulnerability affecting multiple Fortinet products.

CyberQuestor-infosec/CVE-2022-46604-Responsive-File-Manager

rasool13x/exploit-CVE-2025-49113

Repositorio de investigación de seguridad que contiene una Prueba de Concepto (PoC) para la vulnerabilidad CVE-2021-4034 (PwnKit) y utilidades de scripting para la demostración de escalada de privilegios y ejecución remota en entornos Linux.

fearsoff-org/CVE-2025-49113

Superliverbun/cve-2021-3156-

A repository used for Hackthebox ServMon Machine

CVE-2025-4123 - Grafana Tool

An exploit automation script that builds upon the work of Voidzone security.

MantisToboggan-git/CVE-2025-4632-POC

Authenticated Remote Command Execution - Webmin <= 1.910

CVE-2025-49113 - Roundcube <= 1.6.10 Post-Auth RCE via PHP Object Deserialization

r007sec/CVE-2024-53677

For CTF use only (the CVE-2019-7214 also resolves the host from /etc/hosts)

A XZ backdoor vulnerability explained in details

pgAdmin Proof of Concept

Detection for CVE-2025-49113

imbas007/CVE-2025-4123-template

Authenticated Remote Command Execution – pfSense <= 2.1.3

MS08-067 | CVE-2008-4250

A reflected cross-site scripting (XSS) vulnerability exists in MailEnable Webmail due to improper user input sanitization in the failure.aspx. This allows a remote attacker to inject arbitrary JavaScript code via a crafted URL, which is then reflected in the server's response and executed in the context of the user's browser session.

CTY-Research-1/CVE-2025-32432-PoC

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling vulnerability.

fatkz/CVE-2025-27590

Vbullettin RCE - CVE-2025-48827

This Python script exploits CVE-2025-3248 to execute arbitrary commands or spawn a reverse shell on a vulnerable system. Authentication is required to use this exploit.

A go implementation for CVE-2024-9264 which effect grafana versions 11.0.x, 11.1.x, and 11.2.x.

Remote Code Execution via Use-After-Free in JScript.dll (CVE-2025-30397)

This script checks for the OpenSSH 7.7 (and prior) username enumeration vulnerability (CVE-2018-15473). It sends a malformed authentication packet and interprets the SSH server’s response to identify valid usernames.

Automated bash script which scans an ip for potential vulnerability to eternalblue using nmap and then exploit using metasploit framework which uses the CVE-2017-0144 vulnerability[Code name: EternalBlue] in (windows 7,windows 2008 servers,etc.) to gain access to a windows 7 machine and establish a reverse meterpreter shell.