Catálogo de exploits

beyavuz/cve-2026-105080-poc

CVE-2026-59265

tunahantekeoglu/CVE-2025-54769

CVE-2024-4367 PDF.js FontMatrix injection PoC (payload: alert(1)) - authorized pentest artifact

Xen0nize/CVE-2026-21096

Analysis of CVE-2026-86881: An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages

Controlled vulnerability assessment of Metasploitable 2, identifying and validating CVE-2011-2523 in vsftpd 2.3.4 within an isolated lab environment.

kashishtopi/CVE-2026-105314

r30xlqo6从一个辅助 API 看资源边界：CVE-2026-71486（vLLM）w680rjb2afux

Ubuntu's node-braces plus the CVE-2026-93687 nesting-depth fix, for ppa:pillarsdotnet/ppa

CVE-2026-86950

hhg69/CVE-2026-41875-EXPLOIT-QuickCart-one-click-Account-Takeover

Educational lab and clean-room reproduction demonstrating the OS command injection pattern in CVE-2026-105134. For defensive research only.

CVE-2026-39987 Exploit | by infrar3d

PoC and automated code to exploit CVE-2025-57819 in FreePBX. It demonstrates the Remote Code Execution (RCE) vulnerability via command injection in the Asterisk system. Ideal for HackTheBox environments.

CVE-2026-16444 — Arbitrary file write on the controller via TeamViewer Classical File Transfer (TV-2026-1008)

Joomla 4.1.0 exploit

A critical authentication bypass vulnerability in Fortinet products (FortiOS, FortiProxy, and FortiSwitchManager)

CVE-2018-7600 (Drupalgeddon2) — Drupal RCE exploit tool. Standalone Python PoC for authorized security testing. CVSS 9.8 Critical. by K52-ai.

A Proof-of-Concept implementation for CVE-2025-55182, a critical unauthenticated Remote Code Execution vulnerability affecting React Server Components (RSC).

CVE-2026-72898 Metabase SQL injection lab with vulnerable and patched versions, admin session creation, CSV export, order deletion, and recovery.

Hands-on cybersecurity and CTF labs covering service fingerprinting, MySQL enumeration, HTTP clues, SSH discovery, port probing, host discovery, ICA access paths, CVE-2026-13247 WordPress Stored XSS, Thales, and Tomcat security.

TheJesterrrr/CVE-2026-19632

CVE-2026-104991 — Missing Authorization (BOLA/IDOR) in Phproject REST API read/comment endpoints

WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

CVE-2026-103355 - Unlimited Elements For Elementor <= 2.0.20 unauthenticated blind SQL injection via terms-listing identifiers (CVSS 9.3): Docker validation lab with vulnerable (2.0.20) vs patched (2.0.21) controls, read-only boolean-oracle PoC, nuclei version screen. Authorized security research only.

CVE-2026-92084 — Beaver Builder Lite <= 2.11.0.5 unauthenticated arbitrary shortcode execution via Sidebar module widget output (CVSS 9.1): Docker validation lab with vulnerable/patched controls, safe-oracle Python PoC, nuclei version screen. Authorized security research only.

CVE-2026-83627 — Hummingbird Performance <= 3.21.0 Unauthenticated RCE. Pure Python exploit. by K52-ai.

Unauthenticated Privilege Escalation Mass Exploit Super Forms <= 6.3.316 CVE-2026-15989

An end-to-end infrastructure penetration testing lab showcasing automated scanning (Nikto), remote code execution (CVE-2012-1823), and manual kernel privilege escalation to Root (CVE-2008-0600).