Catálogo de exploits

RedArrow3.2 是一款用于渗透测试ThinkPHP 5.0.23 远程命令执行漏洞(CVE-2018-20062)的图形化工具。

Authentication bypass vulnerability in versions of the CrushFTP server.

0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE

tcetin704/CVE-2017-12611

tranphuc2005/CVE-2017-9822

Langflow Remote Code Execution

shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3_2_1_fixed

Documented CVE-2021-41773 (Apache HTTP Server path traversal, CVSS 9.8) — produced CVSS breakdown, impact assessment, and a mitigation plan (patch to 2.4.51+, CGI disable, firewall) and published the analysis on GitHub.

Shubhankargupta691/CVE-2024-42009

CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.

Safe, read-only SQL Injection checker for FreePBX (CVE-2025-57819), using error/boolean/time-based techniques with per-parameter verdicts and JSON reporting.

A proof-of-concept exploit for WinRAR vulnerability (CVE-2025-8088) affecting versions 7.12 and lower. This tool creates a malicious RAR archive that embeds payloads in Alternate Data Streams (ADS) with path traversal, potentially leading to arbitrary code execution.

chin-tech/CrushFTP_CVE-2025-54309

Hands-on pentest project using Kali Linux vs Metasploitable2. Includes full workflow: Nmap scanning, enumeration, Metasploit exploitation (Samba CVE-2007-2447), post-exploitation validation, and mitigation steps. Repo contains commands, outputs, and report showing both offensive techniques and defensive recommendations.

Python PoC script for pgAdmin4 Query Tool RCE (CVE-2025-2945)

Grafana SQL Expressions → DuckDB LFI (CVE-2024-9264)

CVE-2025-48384-submodule

GIT vulnerability | Carriage Return and RCE on cloning

FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied data in endpoints.

Grafana CVE-2025-4123-POC

JinhyukKo/CVE-2024-4701-POC

Ash1996x/CVE-2025-54914-PoC

CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.

For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.

Detection for CVE-2025-42944

In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies.

A hands-on simulation of CVE-2017-5638 (Apache Struts2 RCE), showcasing exploit reproduction, OS-level command execution, and mitigations such as input sanitization and endpoint monitoring. Built in Python/Flask with Jupyter notebook demos

exploit of CVE-2022-0847 which directly remove password of the root account

This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.

To check for vulnerability CVE-2019-13272