Catálogo de exploits

CVE-2025-64446

Apache Tomcat RCE

Penetration test of a Drupal web app — CVE-2018-7600 (Drupalgeddon 2) exploited using Nmap, Burp Suite & Metasploit | Internship @ BB CyberSec

Explore CVE-2021-44228, a vulnerability in log4j affecting almost all software under the sun.

cisco-ise rce poc

rootdirective-sec/CVE-2026-33017-Lab

PoC for CVE-2026-23744, demonstrating an unauthenticated RCE in MCPJam Inspector (<= 1.4.2).

scanner/exploiter CVE-2026-24061 & CVE-2026-32746

PoC exploit for CVE-2025-34282 - ThingsBoard SSRF via SVG Image Upload

Python port of the Linksys tmUnblock.cgi RCE exploit

A Python 3 reimplementation of the classic CVE-2018-15473 OpenSSH user enumeration exploit, extended with multi-threading, wordlist support, automatic vulnerability detection, and thread-safe exploit patching.

pream-totaram/CVE-2024-52302-reproduction

A proof-of-concept exploit demonstrating local privilege escalation to root in sudo (CVE-2025-32463) by abusing the --chroot (-R) option and injecting a malicious NSS configuration

If you've been grinding through HackTheBox machines, Mailing is one of those boxes that genuinely teaches you something. It's rated Easy, runs on Windows, and chains together a few real-world vulnerabilities — a directory traversal, a credential leak, CVE-2024-21413, and a LibreOffice macro exploit. Let's walk through it step by step.

CVE write-up for Active Directory credential exposure vulnerability in Suprema BioStar 2

WinRAR < 7.13 path traversal for persistency

PoC for CVE-2025-49596 on linux targets

Remote Code Execution on MCPJam Inspector <= 1.4.2

Intentionally vulnerable Next.js RSC Docker lab for CVE-2025-55182 (React2Shell) local testing

Master's Thesis research on CVE-2024-30051 (Windows DWM Heap Overflow). Features a high-reliability exploit with automated heap spray optimization, real-time logging, and empirical success-rate analysis. Portfolio piece demonstrating advanced Windows binary exploitation, heap layout manipulation, and LPE via Desktop Window Manager.

Researched and executed real-world CVE exploits in a controlled sandbox: CVE-2000-0168 DoS on Windows 95, ARP Spoofing with NTLMv2 credential interception on Windows XP, and Shellshock RCE via Burp Suite. All activities performed legally for educational purposes.

Static Malware Analysis of Follina (CVE-2022-30190) from Blue Team Labs Online

Advanced Linux Privilege Escalation research on CVE-2021-4034 (PwnKit). Features an optimized exploit with 7 polymorphic payload modes (Interactive Shell, Backdoor, User Creation, Reverse Shell, etc). Portfolio piece focused on memory corruption logic, environment variable manipulation, and anti-forensic techniques.

NeoArtemis37/OverlayFS-PrivEsc-CVE-2022-0944

Advanced security research on CVE-2025-55182 (React2Shell). Features an exploitation framework with 6 functional impact scenarios (RCE to Secret Exfiltration), an interactive reverse shell, and a complete laboratory. Portfolio piece demonstrating deep analysis of Prototype Pollution and Insecure Deserialization in React Server Components

Camera Dahua Research lỗ hổng CVE-2021-33044

CVE-2025-55182 — React2Shell

Technical investigation and host containment of a Critical-severity Zero-Click RCE exploit (CVE-2025-21298) using EDR telemetry and static malware analysis.

CVE-2026-32794: TLS Certificate Verification Bypass in Apache Airflow Databricks Provider

RandyNin/CVE-2023-4220