Catálogo de exploits

tranphuc2005/CVE-2017-9822

Authentication bypass vulnerability in versions of the CrushFTP server.

0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE

Langflow Remote Code Execution

tcetin704/CVE-2017-12611

Safe, read-only SQL Injection checker for FreePBX (CVE-2025-57819), using error/boolean/time-based techniques with per-parameter verdicts and JSON reporting.

CVE-2025-26264 - GeoVision GV-ASWeb with the version 6.1.2.0 or less, contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server, leading to a full system compromise.

Documented CVE-2021-41773 (Apache HTTP Server path traversal, CVSS 9.8) — produced CVSS breakdown, impact assessment, and a mitigation plan (patch to 2.4.51+, CGI disable, firewall) and published the analysis on GitHub.

shoucheng3/apache__dolphinscheduler_CVE-2023-49109_3_2_1_fixed

A proof-of-concept exploit for WinRAR vulnerability (CVE-2025-8088) affecting versions 7.12 and lower. This tool creates a malicious RAR archive that embeds payloads in Alternate Data Streams (ADS) with path traversal, potentially leading to arbitrary code execution.

Shubhankargupta691/CVE-2024-42009

Python PoC script for pgAdmin4 Query Tool RCE (CVE-2025-2945)

Grafana SQL Expressions → DuckDB LFI (CVE-2024-9264)

chin-tech/CrushFTP_CVE-2025-54309

CVE-2025-48384-submodule

Hands-on pentest project using Kali Linux vs Metasploitable2. Includes full workflow: Nmap scanning, enumeration, Metasploit exploitation (Samba CVE-2007-2447), post-exploitation validation, and mitigation steps. Repo contains commands, outputs, and report showing both offensive techniques and defensive recommendations.

GIT vulnerability | Carriage Return and RCE on cloning

Grafana CVE-2025-4123-POC

FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied data in endpoints.

Ash1996x/CVE-2025-54914-PoC

CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.

JinhyukKo/CVE-2024-4701-POC

A hands-on simulation of CVE-2017-5638 (Apache Struts2 RCE), showcasing exploit reproduction, OS-level command execution, and mitigations such as input sanitization and endpoint monitoring. Built in Python/Flask with Jupyter notebook demos

Detection for CVE-2025-42944

exploit of CVE-2022-0847 which directly remove password of the root account

For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.

This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.

In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies.

Nexus Repository 3 Path Traversal (CVE-2024-4956)

Advanced network penetration testing toolkit with SSH vulnerability assessment, CVE-2018-15473 exploitation, stealth brute force capabilities, and fail2ban evasion techniques. Professional-grade security testing framework for authorized penetration testing engagements.