Catálogo de exploits

This is the exploit for the CVE-2025-32463

PoC of cve-2016-6210

rpc.py 0.6.0 - Remote Code Execution (RCE)

Exploit for php-cgi

(PoC) CVE-2025-27210, a precise Path Traversal vulnerability affecting Node.js applications running on Microsoft Windows. This vulnerability leverages the specific way Windows handles reserved device file names

krypton-0x00/CVE-2025-32463-Chwoot-POC

Detection for CVE-2025-47812

Floodnut/CVE-2025-32463

malaya-m/cve-2013-3900-remediation-report

An in-depth analysis of CVE 2023 38408, a critical OpenSSH vulnerability, including technical background, exploitation in controlled environments, and mitigation strategies.

nguyentranbaotran/cve-2025-48384-poc

CVE-2025-53833

Kalidas-7/CVE-2019-9053

joelczk/CVE-2025-52688

CVE-2025-5777 (CitrixBleed 2) - [Citrix NetScaler ADC] [Citrix Gateway]

ECHO6789/CVE-2025-48384-submodule

PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated.

An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 (CitrixBleed 2). This script not only identifies the vulnerability but also helps in demonstrating its impact by parsing human-readable information from the memory leak.

CVE-2025-29927 PoC | Auth Bypass Exploit | Python Tool using httpx | Middleware Vulnerability | Ethical Hacking Toolkit

mheranco/CVE-2025-44136

Privilege escalation to root using sudo chroot, NO NEED for gcc installed.

Armand2002/Exploit-CVE-2025-1974-Lab

This repository contains a proof-of-concept exploit for CVE-2025-48827, a critical authentication bypass vulnerability affecting vBulletin 5.0.0–5.7.5 and 6.0.0–6.0.3 when running on PHP 8.1 or later. The vulnerability allows unauthenticated attackers to invoke protected API methods remotely.

This repository includes the code and files needed to test and execute a PoC for CVE-2025-41656

Royal Elementor Addons - Unauthenticated Remote Code Execution

HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

CVE-2020-35848 impacts Cockpit-CMS v1.7 due to unsafe handling of user inputs in authentication mechanisms, leading to remote code execution. This lab is built for CTF players and bug bounty learners to simulate real-world exploitation workflows including token extraction, password reset, and flag capture.

Wazuh 8.4 CVE-2025-24016

JayVillain/Scan-CVE-2025-6058