Catálogo de exploits

Chatwoot SQL injection in FilterService

wtbacon/cve-2018-15473

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and earlier versions. The exploit is aimed at incorrect authentication due to problems with incorrect privilege settings and command injection.

kaleth4/CVE-2024-6387

Hoverfly CVE RCE

CVE-2022-46364 Apache CXF XOP:Include SSRF / LFI

Automating the exploitation of CVE-2026-7299 - Stored XSS via Database Table/Column Names in SQL Autocomplete within Appsmith =>1.99. Initial discovery 30/03/26

Setup and exploit recreation for CVE-2022-42889 Text4Shell.

CVE-2022-22947 vulnerability task

PoC CVE-2025-54123 - Hoverfly <= 1.11.3 - Authenticated Middleware Command Injection

amikanev/CVE-2025-55182-LAB

akelaqe/CVE-2024-27348-HugeGraph-RCE

vettrivel007/CVE-2024-1086

CVE-2024-6387 OpenSSH 信号竞争漏洞（regreSSHion）分析报告及检测脚本

JacobTaylor3/CVE-2021-21220

Apache ActiveMQ (CVE-2023-46604) zafiyetinden LockBit ransomware aşamasına uzanan 419 saatlik sızma vakasının uçtan uca analizi, SIEM korelasyon kuralları ve IOC listesi.

0x0asif/CVE-2025-55182

CVE-2025-54123 exploit and documentation

This vulnerability allows an attacker to perform SSRF (Server-Side Request Forgery) attacks on Apache CXF webservices that accept MTOM/XOP requests. The issue exists in how the href attribute of xop:Include is parsed, allowing arbitrary URLs to be requested by the server.

Shashivanth009/CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

CVE-2022-46364-Poc Apache CXF SSRF via MTOM XOP:Include

BOLA/IDOR vulnerability in osTicket ajax.tickets.php | Responsible Disclosure

A PoC demonstrating a RCE in Hoverfly (versions ≤ 1.11.3) by abusing the /api/v2/hoverfly/middleware endpoint and injecting a malicious middleware script

Explota vulnerabilidad

Chrome extension that uses vulnerabilities CVE-2021-33044 and CVE-2021-33045 to log in to Dahua cameras without authentication.

CVE-2025-54123 Hoverfly Authenticated Middleware Command Injection RCE

Drupal 7 CMS vulnerable to CVE-2018-7600 (Drupalgeddon2), allowing unauthenticated remote code execution.

Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe

Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe

BastianXploited/CVE-2025-6440