Catálogo de exploits

Hands-on pentest project using Kali Linux vs Metasploitable2. Includes full workflow: Nmap scanning, enumeration, Metasploit exploitation (Samba CVE-2007-2447), post-exploitation validation, and mitigation steps. Repo contains commands, outputs, and report showing both offensive techniques and defensive recommendations.

infoleak

CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.

client-side

JinhyukKo/CVE-2024-4701-POC

FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied data in endpoints.

Ash1996x/CVE-2025-54914-PoC

Grafana CVE-2025-4123-POC

GIT vulnerability | Carriage Return and RCE on cloning

Detection for CVE-2025-42944

A hands-on simulation of CVE-2017-5638 (Apache Struts2 RCE), showcasing exploit reproduction, OS-level command execution, and mitigations such as input sanitization and endpoint monitoring. Built in Python/Flask with Jupyter notebook demos

In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies.

exploit of CVE-2022-0847 which directly remove password of the root account

initial-access

local

For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.

local

infoleak

This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.

infoleak

CVE‑2025‑42957 exposes an RFC‑enabled SAP S/4HANA module that lets low‑privileged users inject ABAP code to create admin accounts and gain full control. The article explains the vulnerability, threat model, provides minimal exploit ABAP code, and lists patching & monitoring steps to secure the system

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

Nexus Repository 3 Path Traversal (CVE-2024-4956)

CVE-2025-24893 RCE exploit for XWiki with reverse shell capability

PoC CVE-2025-31161 - Authentication Bypass CrushFTP

initial-access

Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-

To check for vulnerability CVE-2019-13272

Jenkins CLI arbitrary file read (CVE-2024-23897)

Linux privilege escalation using Dirty COW exploit (CVE-2016-5195).