Catálogo de exploits

CVE-2026-72898 Metabase SQL injection lab with vulnerable and patched versions, admin session creation, CSV export, order deletion, and recovery.

CVE-2026-83627 — Hummingbird Performance <= 3.21.0 Unauthenticated RCE. Pure Python exploit. by K52-ai.

CVE-2026-92084 — Beaver Builder Lite <= 2.11.0.5 unauthenticated arbitrary shortcode execution via Sidebar module widget output (CVSS 9.1): Docker validation lab with vulnerable/patched controls, safe-oracle Python PoC, nuclei version screen. Authorized security research only.

Hands-on cybersecurity and CTF labs covering service fingerprinting, MySQL enumeration, HTTP clues, SSH discovery, port probing, host discovery, ICA access paths, CVE-2026-13247 WordPress Stored XSS, Thales, and Tomcat security.

CVE-2026-103355 - Unlimited Elements For Elementor <= 2.0.20 unauthenticated blind SQL injection via terms-listing identifiers (CVSS 9.3): Docker validation lab with vulnerable (2.0.20) vs patched (2.0.21) controls, read-only boolean-oracle PoC, nuclei version screen. Authorized security research only.

TheJesterrrr/CVE-2026-19632

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

CVE-2026-104991 — Missing Authorization (BOLA/IDOR) in Phproject REST API read/comment endpoints

Guest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.

CVE-2026-103956 - Loom for AWS - Critical - Auth bypass - unauthenticated super-admin when no IdP is configured

MotionEye OS Command Injection (CVE-2025-60787)

Hands-on Learn SecByte CTF labs covering Beelzebub preparation, VM and network clues, Base64, CVE-2026-14461, admin panels, authentication, credential leaks, kernel security, reused keys, SQLMap, and web-to-root concepts.

Proof of concept for CVE-2026-92592: Craft CMS authenticated RCE

CVE-2026-103648 | Path Traversal in image-downloader 4.3.0 | CVSS 9.1 Critical | CWE-22 | By EterNullSec

A python3 PoC for CVE-2026-105030 Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

CVE-2026-63030 & CVE-2026-60137 RCE chain proof-of-concept

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).

Unauthenticated Privilege Escalation Mass Exploit Super Forms <= 6.3.316 CVE-2026-15989

Proof-of-concept scanner and exploit helper for CVE-2026-14378: unauthenticated administrator session takeover in the WordPress plugin DevKit Pro (dplugins) through a flawed user-switch “revert” flow.

SFADMIN - CVE-2026-15989 Super Forms <= 6.3.316 unauthenticated privilege escalation (mass scanner + exploit)

CVE-2026-63292

Penetration testing portfolio: FTP vulnerability assessment & exploitation in isolated lab. Demonstrates network reconnaissance, CVE-2011-2523 validation, and post-exploitation verification. Complete methodology with evidence, findings, and remediation guidance.

Divi Membership (DiviEngine) pre-auth admin takeover — CVE-2026-19660 paypal_param bypass. Python PoC with exploit + cookie export.

Exploitability PoC for CVE-2026-102-268 (PyJWT Asymmetric-PEM detection bypass).

CPython - Critical - SNI SSLContext UAF

CVE-2026-102282: adm-zip LPE via SUID/SGID preservation during archive extraction (fixed in 0.6.1)

PoC for CVE-2026-14378: DevKit Pro ≤2.3.0 unauthenticated admin takeover via original_user_id cookie + revert_switch nonce. check/admin + mass scan.

Exploited a known RCE vulnerability (PHP-CGI Argument Injection, CVE-2012-1823) on Metasploitable2 using Metasploit Framework, gained a shell, and documented post-exploitation