Catálogo de exploits

ycseo-git/CVE-2020-11800

Proof-of-concept for CVE-2024-4040 (CrushFTP SSTI -> unauthenticated LFI) in a controlled CS443 lab environment - for educational/authorised use only.

MartinaStarone/CVE-2026-2441

mawussid/CVE-2026-41651-Python

Proof-of-concept exploit for CVE-2024-22120 that leverages time-based SQL injection and gopher-based SSRF to achieve remote code execution on vulnerable Zabbix servers for educational security research.

mitigation of cve-2026-31431 using ftrace

CVE-2026-41940 Auto Root Login

Test authentication bypass vulnerabilities in cPanel and WHM using this proof of concept exploit tool written in Go.

PoC for CVE-2026-41940: WHM/cPanel authentication bypass chain (Python 2.7). For authorized security research and testing only.

Exploit CVE-2026-31431 on Linux using a Rust implementation to achieve local privilege escalation via an arbitrary page cache write primitive.

CVE-2011-1249 (MS11-046) AFD privilege escalation — MinGW cross-compilation fix + custom command support

C implementation for researching Copy Fail (CVE-2026-31431)

Zimbra Path Traversal (CVE-2025-68645) - Unauthenticated file read vulnerability in Zimbra Collaboration Suite

This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution (RCE) vulnerability in Samsung MagicINFO 9 Server (versions prior to 21.1052).

roodhelios/CVE-2022-26134-OGNL-Injection

Analysis of network scan results, service vulnerabilities, OS fingerprinting, and critical Nessus findings including Ghostcat (CVE-2020-1938).

This repository contains an academic and technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting the MOVEit Transfer application, a widely used enterprise Managed File Transfer (MFT) platform. The project was developed as part of the CYB625 – Ethical Hacking & Penetration Testing course at Pace University.

One IPv6 ND option with length zero. One missing check. Daemon walks backward and lives in the loop. Reported to OpenBSD, fixed, CVE assigned.

Analysis of CVE-2026-24072

Passive HTTP metadata auditor for CVE-2026-23918 exposure triage

Exploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.

Pentesting caja negra: Shellshock (CVE-2014-6271) + Log4Shell (CVE-2021-44228). Escalada a root. Informe ejecutivo y técnico

LPE due to integer truncation in vskrnlintvsp.sys

Pentesting caja negra: Shellshock (CVE-2014-6271) + Log4Shell (CVE-2021-44228). Escalada a root. Informe ejecutivo y técnico

ZildanZ/CVE-2026-41940

Detection signatures for CVE-2026-41940 and shemas for cPanel logs

Simple exploit

Утилита для Linux, которая проверяет доступность `AF_ALG`/`algif_aead` и помогает оценить риск по `CVE-2026-31431`.

6abc/Copy-Fail-CVE-2026-31431-dirty-frag-CVE-2026-43284

Safe detection tooling for CVE-2026-31431 "Copy Fail" and CVE-2026-43284 "Dirty Frag" — a local privilege escalation in the Linux kernel's algif_aead module affecting all major distributions since 2017.