Catálogo de exploits

Relatório TryHackMe — n8n CVE-2025-68613 (CVSS 9.9)

Dirty Cow exploit - CVE-2016-5195

Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation

Unauthenticated 0-click RCE exploit for CVE-2024-9932. Exploits an arbitrary file upload vulnerability in the Wux Blog Editor WordPress plugin to upload a remote PHP payload, detect the target operating system, and achieve remote command execution through an interactive web shell.

A hands-on project demonstrating the setup of virtual security lab, network reconnaissance, and exploitation of CVE-2012-1823.

Unauthenticated 0-click RCE exploit for CVE-2023-51409. Abuses an arbitrary file upload flaw in the AI Engine WordPress plugin to upload a PHP webshell and achieve remote command execution without authentication, including OS detection and an interactive shell.

Unauthenticated 0-click RCE exploit for CVE-2024-50498. Exploits a code injection vulnerability in the LUBUS WP Query Console plugin to execute arbitrary PHP code, write a web shell to the uploads directory, detect the target operating system, and achieve remote command execution via an interactive shell.

React Router's createFileSessionStorage() in certain versions allows unsigned cookies to be manipulated, enabling file system access outside the session directory.

afifudinmtop/CVE-2021-21425

CVE-2017-7921, CVE-2021-36260 updated 21/01/2026

nimesh895/Malware-Analysis-Follina-CVE-2022-30190

CybersRMUTL/CVE-2019-10149-Exim4-RCE

Final Project in Fundamental network security,POC CVE-202438063

This Poc demonstrate Arbitrary read/write primitives provided by CVE-2025-7771

CybersRMUTL/CVE-2019-9193-Postgresql-RCE

InfoSecAntara/CVE-2025-14847-MongoDB

SMBv1: CVE-2017-0143, gravedad 8.8, de ejecucion remota de codigo (RCE), en Windows con SMBv1 (ms17-010)

海康威视RCE漏洞 批量检测和利用工具

abanop22333/Apache-Authentication-Flaw-Research-CVE-2024-38476-

MOVEit Transfer 2023 mass data breach (CVE-2023-34362)

CVE-2017-7921, CVE-2021-36260 updated 21/01/2026

CVE-2025-55182 React Server Components Remote Code Execution Exploit Lab

CVE-2025-55182(命令执行、反弹shell、注入内存马)

Vladjrfhfg/React-site-CVE-2025-55182

This script is used to identify MongoDB services that are network-exposed and allow unauthenticated protocol handshakes.

Cacti exploit

A tool designed to exploit CVE-2025-54068 and Remote Command Execution of the Livewire project.

SSP H3

vsftpd 2.3.4 (CVE-2011-2523) a critical vulnerability that leads to Reverse Root Shell. In this repo I will do a PoC how to exploit it step by step, Manually & Automatically (Python) for educational purposes.

CVE-2026-23744 - Versions 1.4.2 and earlier of MCPJam inspector are vulnerable to remote code execution (RCE). Because the tool listens on 0.0.0.0 by default, an attacker can trigger the installation and execution of a malicious MCP server by sending a crafted HTTP request. Version 1.4.3 contains a patch for this issue.