Catálogo de exploits

exploit of CVE-2022-0847 which directly remove password of the root account

For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.

This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.

A hands-on simulation of CVE-2017-5638 (Apache Struts2 RCE), showcasing exploit reproduction, OS-level command execution, and mitigations such as input sanitization and endpoint monitoring. Built in Python/Flask with Jupyter notebook demos

PoC CVE-2025-31161 - Authentication Bypass CrushFTP

Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-

Jenkins CLI arbitrary file read (CVE-2024-23897)

CVE-2025-24893 RCE exploit for XWiki with reverse shell capability

To check for vulnerability CVE-2019-13272

Nexus Repository 3 Path Traversal (CVE-2024-4956)

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

Linux privilege escalation using Dirty COW exploit (CVE-2016-5195).

Advanced network penetration testing toolkit with SSH vulnerability assessment, CVE-2018-15473 exploitation, stealth brute force capabilities, and fail2ban evasion techniques. Professional-grade security testing framework for authorized penetration testing engagements.

CVE‑2025‑42957 exposes an RFC‑enabled SAP S/4HANA module that lets low‑privileged users inject ABAP code to create admin accounts and gain full control. The article explains the vulnerability, threat model, provides minimal exploit ABAP code, and lists patching & monitoring steps to secure the system

script de enumeración de usuarios SSH basado en diferencias de timing y respuestas de autenticación. Explota el mismo vector que CVE-2018-15473 en versiones vulnerables de OpenSSH (≤ 7.7), aunque también puede revelar patrones en configuraciones modernas.

This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).

In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host

Log4Shell CVE-2021-44228 PoC

This repository contains the corrected code for CVE: 2019-9053

PoC Script for the CVE-2018-11776 vuln

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption

FuelCMS 1.4.1 Command Injection/Remote Code Execution.

CVE-2024-6387

boriitoo/CVE-2012-2982

Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization Remote Code Execution (RCE) – CVE-2023-46604

CVE-2025-54914 exposes a critical flaw in Azure Networking that allows attackers to escalate privileges and control routing across subnets. The article explains how a missing privilege check in the “GetRouteTable” API enables lateral movement and remote exploitation, urging immediate patching and monitoring

CVE-2025-47812

Este repositorio contiene un exploit automatizado desarrollado con fines educativos y de investigación en ciberseguridad, dirigido a demostrar una potencial vulnerabilidad de ejecución remota de código (RCE) en Apache Tomcat (CVE-2025-24813).

CVE-2025-7771 ThrottleStop.sys privilege escalation exploit - unrestricted IOCTL access to physical memory via MmMapIoSpace

CVE-2025-23266 targets FastAPI’s parse_request() function, where oversized HTTP headers cause a buffer overflow and remote code execution. The article explains how attackers can escape container boundaries, compromise AI workloads, and how tools like Sentinel can detect and mitigate the threat