Catálogo de exploits

🛡️ CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit

Unauthenticated Arbitrary File Read via Absolute Path

Shuhaib88/Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Proof of Concept for CVE-2024-9463

Proof-of-concept scanner targeting CVE-2024-21762 in FortiOS SSL VPN’s /remote/hostcheck_validate endpoint with reverse shell payload delivery.

Public disclosure of CVE-2025-31200 – Zero-click RCE in iOS 18.X via AudioConverterService and malicious audio file.

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

Script to exploit Grafana CVE-2025-4123: XSS and Full-Read SSRF

eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image Task

Exploitation and Post-Exploitation Multitool for Palo Alto PAN-OS Systems affected by vulnerabilities CVE-2024-0012 and CVE-2024-9474

CVE-2021-34527 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare."

RdBBB3/SHELL-POC-CVE-2022-46169

PoC and vulnerability report for CVE-2025-47827.

IndominusRexes/CVE-2025-4322-Exploit

HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI)

It was determined that malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. # It was determined that only certain operating systems and operating system versions were affected by this vulnerability.

CVE-2024-53677

PoC for CVE-2025-47646 - WordPress PSW Front-end Login Registration Plugin ≤ 1.12 Unauthenticated Privilege Escalation

Um script automatizado melhorando o exploit do cve-2011-0762 postado no exploit-db

Vulnerabilidad NTLM (CVE-2025-24054) explotada para robo de hashes

Automated path traversal testing tool for Grafana plugin endpoints using curl and Bash.

The `swp_debug` parameter in `admin-post.php` allows remote attackers to include external files containing malicious PHP code, which are evaluated on the server. By supplying a crafted URL that hosts a reverse shell payload, an attacker can gain command execution.

Designed for Demonstration of Deep Exploitation.

Mitel MiCollab Authentication Bypass to Arbitrary File Read

tdevworks/CVE-2020-1472-ZeroLogon-Demo-Detection-Mitigation

CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation (CVE-2025-31201), and allowed token theft until patched in iOS 18.4.1 (Apr 16, 2025).

Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation

Automation Exploit

tdevworks/CVE-2020-0796-SMBGhost-Exploit-Demo

CyprianAtsyor/LetsDefend-CVE-2022-41082-Exploitation-Attempt