Catálogo de exploits

Jenkins CLI arbitrary file read (CVE-2024-23897)

Advanced network penetration testing toolkit with SSH vulnerability assessment, CVE-2018-15473 exploitation, stealth brute force capabilities, and fail2ban evasion techniques. Professional-grade security testing framework for authorized penetration testing engagements.

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

To check for vulnerability CVE-2019-13272

CVE‑2025‑42957 exposes an RFC‑enabled SAP S/4HANA module that lets low‑privileged users inject ABAP code to create admin accounts and gain full control. The article explains the vulnerability, threat model, provides minimal exploit ABAP code, and lists patching & monitoring steps to secure the system

Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-

Linux privilege escalation using Dirty COW exploit (CVE-2016-5195).

CVE-2025-24893 RCE exploit for XWiki with reverse shell capability

Nexus Repository 3 Path Traversal (CVE-2024-4956)

script de enumeración de usuarios SSH basado en diferencias de timing y respuestas de autenticación. Explota el mismo vector que CVE-2018-15473 en versiones vulnerables de OpenSSH (≤ 7.7), aunque también puede revelar patrones en configuraciones modernas.

Log4Shell CVE-2021-44228 PoC

PoC Script for the CVE-2018-11776 vuln

In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host

This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).

This repository contains the corrected code for CVE: 2019-9053

FuelCMS 1.4.1 Command Injection/Remote Code Execution.

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption

Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization Remote Code Execution (RCE) – CVE-2023-46604

CVE-2025-47812

boriitoo/CVE-2012-2982

CVE-2025-54914 exposes a critical flaw in Azure Networking that allows attackers to escalate privileges and control routing across subnets. The article explains how a missing privilege check in the “GetRouteTable” API enables lateral movement and remote exploitation, urging immediate patching and monitoring

Este repositorio contiene un exploit automatizado desarrollado con fines educativos y de investigación en ciberseguridad, dirigido a demostrar una potencial vulnerabilidad de ejecución remota de código (RCE) en Apache Tomcat (CVE-2025-24813).

CVE-2024-6387

CTY-Research-1/CVE-2025-47812_Lab_environment

CVE-2025-7771 ThrottleStop.sys privilege escalation exploit - unrestricted IOCTL access to physical memory via MmMapIoSpace

CVE-2025-23266 targets FastAPI’s parse_request() function, where oversized HTTP headers cause a buffer overflow and remote code execution. The article explains how attackers can escape container boundaries, compromise AI workloads, and how tools like Sentinel can detect and mitigate the threat

This is CVE-2025-53690 Analysis Documents.

Boon-Rekcah/CMS-Made-Simple-2.2.9-CVE-2019-9053

PoC showing unauthenticated remote code execution in Erlang/OTP SSH server. By exploiting a flaw in SSH protocol message handling, an attacker can execute arbitrary commands on the target without valid credentials.

This repository contains a Metasploit module implementation for the MS08-067 Windows Server Service vulnerability (CVE-2008-4250). This is a classic remote code execution vulnerability affecting older Windows systems.