Catálogo de exploits

nicolasdamians/ms09-050-CVE-2009-3103-exploit

PoC exploit for CVE-2018-11736 affecting Pluck CMS versions prior to 4.7.7-dev2 with a File Upload Vulnerability

NextJS exploiter for CVE-2025-55182 and more.

tamagorengs/react2shell-poc-CVE-2025-55182

CVE-2019-11231 PoC

writeups for (CVE-2025-67586, CVE-2025-67985, CVE-2025-67986)

RSC Detect CVE 2025 55182

CVE-2025-55182 React2Shell PoC - Critical RCE in React Server Components / Next.js. CVSS 10.0. Error-based exfil, reverse shell, interactive mode.

Secure-by-default demo lab showing how container hardening (distroless images, non-root, read-only filesystem, runtime-injected secrets) can neutralize a critical Next.js/React Server Actions RCE (CVE-2025-55182 “React2Shell”), with side-by-side safe vs unsafe deployments and exploit logs

A self-hosted vulnerable Next.js environment running on Docker for simulating CVE-2025-55182. Built for educational security research and CTF practice.

FreeBSD rtsold DNSSL Command Injection (RCE)

PaperCut NG/MG Authentication Bypass and Remote Code Execution (RCE) Exploit Tool. A standalone Bash implementation of the PaperCut exploit chain, featuring optional proxy support, automated session elevation, and dynamic command injection via the print scripting engine. Designed for security auditing and authorized penetration testing.

open-flaw/CVE-2025-55182

PoC for CVE-2025-37164

CVE-2025-13486 - Remote Code Execution & Privilege Escalation exploit

Detection for CVE-2025-68461

React2Shell vulnerability (CVE-2025-55182 / CVE-2025-66478) Full Script

lamaper/CVE-2025-55182-Toolbox

A Python-based security scanner for detecting and exploiting **React Server Components (RSC)** vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing.

React2Shell Vulnerability Verification Script (React2Shell also known as CVE-2025-55182).

Detection for CVE-2025-37164

cyberok-org/CVE-2025-67887

Script to detect CVE-2025-20393 for Cisco Secure Email Gateway And Cisco Secure Email and Web Manager

Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'

KingHacker353/CVE-2025-20393

Proof of Concept for Authenticated RCE in Crafty Controller

Cisco is aware of a potential vulnerability.  Cisco is currently investigating and will update these details as appropriate as more information becomes available.

Detection for CVE-2025-40602

CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console (AMC) of SonicWall Secure Mobile Access (SMA) 1000 series appliances.

POC for CVE-2025-33053 WebDav Exploit, demonstrating how the vulnerability can be triggered in a real environment. This repository focuses on hands-on exploitation steps, reproducible test cases, and observable impact, helping security researchers and defenders understand the issue and validate fixes.