Catálogo de exploits

Chocapikk/CVE-2025-32463-lab

Citrix Bleed 2 PoC Scanner (CVE-2025-5777)

A PoC exploit for CVE-2025-32463 - Sudo Privilege Escalation

Ruby on Rails Web Console Exploit (CVE-2015-3224)

cve-2025-32462' demo

CVE-2025-32463

Royall-Researchers/CVE-2024-9264

Grafana RCE

Papercut Vulnerability, Affected Versions are PaperCut MF or NG version 8.0 or later (excluding patched versions) on all OS platforms.

CitrixBleed2 poc

Memory disclosure vulnerability in Citrix NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy).

gmh5225/CVE-2025-6554

gmh5225/CVE-2025-6554-2

ibrahmsql/discourse-CVE-2021-41163

ibrahmsql/CVE-2021-41163

Royall-Researchers/CVE-2025-24071

r0otk3r/CVE-2021-41773

🔓 Local privilege escalation PoC for CVE-2025-32462 (sudo -h bypass) – gain root via misconfigured sudoers

CVE-2025-41646 - Critical Authentication bypass

POC to exploit WordPress 5.6-5.7 (PHP 8+) Authenticated XXE Injection.

Remote Command Execution exploit for Wing FTP Server (CVE-2025-47812)

🛡️ Proof of Concept (PoC) for CVE-2025-32463 — Local privilege escalation in sudo (versions 1.9.14 to 1.9.17). This exploit abuses the --chroot option and a malicious nsswitch.conf to execute arbitrary code as root. ⚠️ For educational and authorized testing only.

# CVE-2025-32463 – Sudo EoP Exploit (PoC) with precompiled .so

Privilege escalation exploit for CVE-2025-32463 using a malicious NSS module injected via sudo -R. This version creates a stealth payload called illdeed, granting root access through a controlled chroot environment.

Exploit for CVE-2024-4040 – Authentication bypass in CrushFTP via CrushAuth cookie and AWS-style header spoofing. Stealthy Python PoC with secure token generation, SSL bypass, and improved output.

CitrixBleed-2 (CVE-2025-5777) – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed”

CVE-2023-46747-RCE PoC

Unauthenticated Remote Code Execution exploit for CVE-2025-20281 in Cisco ISE ERS API. Execute commands or launch reverse shells as root — no authentication required.

MCP-Inspector-vulncheck is a Python script that checks if an MCP Inspector server is vulnerable to CVE-2025-49596. It tests whether the /sse endpoint responds to unauthenticated requests, indicating a potential security flaw. The script is simple to use and provides clear output on whether the target server is likely vulnerable or patched.

Multi-host, multi-port scanner and auditor for CVE-2025-6543-affected NetScaler devices. Supports SNMP and SSH enumeration with optional CSV reporting and exploit stubs.