Catálogo de exploits

CVE‑2025‑42957 exposes an RFC‑enabled SAP S/4HANA module that lets low‑privileged users inject ABAP code to create admin accounts and gain full control. The article explains the vulnerability, threat model, provides minimal exploit ABAP code, and lists patching & monitoring steps to secure the system

Jenkins CLI arbitrary file read (CVE-2024-23897)

Nexus Repository 3 Path Traversal (CVE-2024-4956)

PoC CVE-2025-31161 - Authentication Bypass CrushFTP

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

To check for vulnerability CVE-2019-13272

Linux privilege escalation using Dirty COW exploit (CVE-2016-5195).

CVE-2025-24893 RCE exploit for XWiki with reverse shell capability

FuelCMS 1.4.1 Command Injection/Remote Code Execution.

In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host

Log4Shell CVE-2021-44228 PoC

script de enumeración de usuarios SSH basado en diferencias de timing y respuestas de autenticación. Explota el mismo vector que CVE-2018-15473 en versiones vulnerables de OpenSSH (≤ 7.7), aunque también puede revelar patrones en configuraciones modernas.

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption

This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).

This repository contains the corrected code for CVE: 2019-9053

PoC Script for the CVE-2018-11776 vuln

CVE-2024-6387

CVE-2025-54914 exposes a critical flaw in Azure Networking that allows attackers to escalate privileges and control routing across subnets. The article explains how a missing privilege check in the “GetRouteTable” API enables lateral movement and remote exploitation, urging immediate patching and monitoring

Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization Remote Code Execution (RCE) – CVE-2023-46604

boriitoo/CVE-2012-2982

CVE-2025-47812

Este repositorio contiene un exploit automatizado desarrollado con fines educativos y de investigación en ciberseguridad, dirigido a demostrar una potencial vulnerabilidad de ejecución remota de código (RCE) en Apache Tomcat (CVE-2025-24813).

CTY-Research-1/CVE-2025-47812_Lab_environment

CVE-2025-23266 targets FastAPI’s parse_request() function, where oversized HTTP headers cause a buffer overflow and remote code execution. The article explains how attackers can escape container boundaries, compromise AI workloads, and how tools like Sentinel can detect and mitigate the threat

Boon-Rekcah/CMS-Made-Simple-2.2.9-CVE-2019-9053

This is CVE-2025-53690 Analysis Documents.

PoC showing unauthenticated remote code execution in Erlang/OTP SSH server. By exploiting a flaw in SSH protocol message handling, an attacker can execute arbitrary commands on the target without valid credentials.

CVE-2025-7771 ThrottleStop.sys privilege escalation exploit - unrestricted IOCTL access to physical memory via MmMapIoSpace

PoC exploit for CVE-2024-28397 – Remote Code Execution in pyload-ng via js2py sandbox escape

whisperer1290/CVE-2025-54309__Enhanced_exploit