Catálogo de exploits

yuimamur/CVE-2024-4367-hands-on

Dungsocool/CVE-2026-60137_CVE-2026-63030

A Python-based static patch analysis tool for studying the root cause and remediation of CVE-2021-41773 (Apache HTTP Server Path Traversal) by comparing the vulnerable Apache HTTP Server 2.4.49 source code with the patched 2.4.51 implementation.

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

CVE-2026-65008

A poc for a vulnerability in ZTE File Manager (zte.com.cn.filer) which allows to read arbitrary files from other apps as the privileges of this file manager

nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.

CVE-2026-43499: Linux kernel futex PI use-after-free research package

initial-access

CVE-2026-63030 + CVE-2026-60137+poc

PoC and analysis of CVE-2021-41773

soralis0912/CVE-2026-43499-pmg110-root

Phucc29/CVE-2025-55182

Unprivileged user to root on macOS Sonoma, Sequoia, and Tahoe. Patched in macOS 26.6 / 15.7.8 / 14.8.8.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

info-leak

CVE-2026-54121 (Certighost) AD CS DC-impersonation PoC. Patched SAN handling + MAQ-safe account reuse.

CVE-2026-57973 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Microsoft Windows Subsystem for Linux (WSL2) that allows an authorized local attacker to perform tampering.

initial-access

Procjevt/CVE-2026-58138

Security Advisory: Unauthenticated NULL Pointer Dereference Crashes the Server (TinyWeb)

initial-access

Security Advisory: Unchecked Room Lookup Leads to Server Crash (Let's Chat)

Docker-based isolated proof-of-concept lab for analysing CVE-2021-44228 (Log4Shell) for the COMP6441 Security Engineering project.

Security Advisory: HTTP Header Injection via Unvalidated CR and LF in Header Values (tiny_http)

Security Advisory: Unauthenticated Memory Leak Leads To Memory Exhaustion (TinyWeb)

CVE-2026-58480 / CVE-2026-15158 — Unauthenticated RCE in Blocksy Companion Pro < 2.1.47 (300K+ installs). Pre-auth arbitrary file upload via double-extension bypass.

Security Advisory: Unauthenticated Path Traversal Allows Arbitrary File Read (TinyWeb)

A C-based Linux security utility for detecting, safely verifying (Proof of Concept), and mitigating CVE-2026-64600 (RefluXFS). It provides kernel vulnerability assessment, XFS reflink detection, a safe race-condition PoC, and layered mitigation using SystemTap and XFS hardening.

initial-access