Catálogo de exploits

Firefox content-to-parent IPDL privilege escalation (N-day, bug 2054416): forged PDocumentChannel with RemoteTypeOverride -> privilegedabout process placement, via mojo-port send-path injection from a compromised content process

Reproducer for CVE-2026-28672 (Apache Ranger UnixUserGroupBuilder OS command injection via username in the unixusersync module)

SIMPLE EXPOIT FOR CVE-2025-55182 FOR RCE , COMMAND INJECTIONS AND OTHER VULNERABILITIES

Patch: Remote code execution in SPL parsing (Splunk Enterprise)

T0w0T/POC-CVE-2026-18963

IDOR + Stored XSS via Broken Object-Level Authorization in JoomGallery

chessalekin/cve-2026-9198_exploit

PoC exploit chain for CVE-2026-15718: SpiderMonkey wasm baseline compiler array.fill missing-sync -> invalid pointer -> addrOf/fakeobj -> arbitrary R/W -> RCE

h00die/POC-CVE-2026-19681

From MCPJam Inspector RCE to root — CVE-2026-23744, JupyterLab token disclosure, kernel execution, and OPSMCP privilege escalation

Exploiting the vsftpd 2.3.4 backdoor (CVE-2011-2523) on Metasploitable2 — a hands-on pentesting lab writeup covering recon, exploitation, and remediation.

Reproducible lab for CVE-2026-10053 (GitLab npm package-registry path traversal -> arbitrary file write as git). Vulnerable 19.2.1 vs patched 19.2.2, deterministic oracle.

Legendile7/CVE-2026-78122-POC

Password-Protected Category Bypass via JSON Format in JoomGallery

Professional PHPMyAdmin 5.0.0 SQL Injection (CVE-2020-5504) exploitation framework with automated database enumeration, table extraction, and data dumping capabilities. Features blind injection, proxy support, JSON output, and comprehensive error handling for authorized penetration testing and security research. Author: Sudeepa Wanigarathna

CVSS v3.1 assessment of CVE-2009-0658 (Adobe Acrobat Buffer Overflow), including Base, Temporal, and Environmental scoring and remediation recommendations.

Exploit Title: Unauthenticated SQL Injection on CMS Made Simple <= 2.2.9

Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC (CVE-2004-2687), privilege escalation via udev netlink (CVE-2009-1185), and vsftpd 2.3.4 backdoor analysis (CVE-2011-2523), with firewall mitigation validated end-to-end.

Stored XSS in J2Commerce Guest Checkout via Cookie Filter Bypass

MinhHK68/CVE-2026-13736

Gitlab-CVE-2026-19478

initial-access

내 공유기가 Zbtlink ENDLESSDOORS 백도어(CVE-2026-66747) 대상인지 클릭 한 번으로 검사하는 Windows 프로그램

POC pre-auth RCE on Exchange

Apple MacOS Screen Sharing Arbitrary File read/write -> RCE

initial-access

CVE-2026-32475

local

CVE-2026-9198 - IBM Langflow OSS Unauthenticated Remote Code Execution (RCE)

ts zeroday exp made by nullsec white team