Catálogo de exploits

CVE-2024-3094 exposed a backdoor in the XZ compression library, allowing remote SSH access by bypassing authentication. It’s a major supply chain attack affecting Linux systems, highlighting risks in trusted open-source components.

JinhyukKo/CVE-2024-4701-POC

FreePBX versions 15, 16, and 17 contain a Remote Code Execution (RCE) vulnerability caused by insufficient sanitization of user-supplied data in endpoints.

Detection for CVE-2025-42944

This repository contains **research and analysis** related to CVE-2025-29927. It demonstrates safe, controlled testing approaches for a path traversal/middleware misconfiguration vulnerability in web applications.

In-depth study of CVE-2019-18935 affecting Telerik UI for ASP.NET AJAX. Covers .NET deserialization vulnerability, RadAsyncUpload handler, gadget chains, mixed-mode assembly exploitation, and mitigation strategies.

A hands-on simulation of CVE-2017-5638 (Apache Struts2 RCE), showcasing exploit reproduction, OS-level command execution, and mitigations such as input sanitization and endpoint monitoring. Built in Python/Flask with Jupyter notebook demos

For CTF's and Safe Environments.... CVE-2021-4034 Local PrivEsc.

exploit of CVE-2022-0847 which directly remove password of the root account

CVE‑2025‑42957 exposes an RFC‑enabled SAP S/4HANA module that lets low‑privileged users inject ABAP code to create admin accounts and gain full control. The article explains the vulnerability, threat model, provides minimal exploit ABAP code, and lists patching & monitoring steps to secure the system

To check for vulnerability CVE-2019-13272

PoC CVE-2025-31161 - Authentication Bypass CrushFTP

Jenkins CLI arbitrary file read (CVE-2024-23897)

Linux privilege escalation using Dirty COW exploit (CVE-2016-5195).

CVE-2025-24893 RCE exploit for XWiki with reverse shell capability

This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)

Nexus Repository 3 Path Traversal (CVE-2024-4956)

Advanced network penetration testing toolkit with SSH vulnerability assessment, CVE-2018-15473 exploitation, stealth brute force capabilities, and fail2ban evasion techniques. Professional-grade security testing framework for authorized penetration testing engagements.

Zuack55/Roundcube-1.6.10-Post-Auth-RCE-CVE-2025-49113-

PoC Script for the CVE-2018-11776 vuln

This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).

script de enumeración de usuarios SSH basado en diferencias de timing y respuestas de autenticación. Explota el mismo vector que CVE-2018-15473 en versiones vulnerables de OpenSSH (≤ 7.7), aunque también puede revelar patrones en configuraciones modernas.

This repository contains the corrected code for CVE: 2019-9053

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption

FuelCMS 1.4.1 Command Injection/Remote Code Execution.

In OctoPrint version <=1.11.2, an attacker with file upload access (e.g., valid API key or session) can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote code execution (RCE) on the host

Log4Shell CVE-2021-44228 PoC

boriitoo/CVE-2012-2982

Vulnerability Detection and Mitigation Apache ActiveMQ | Security Architectures and Systems Administration - on - Apache ActiveMQ Deserialization Remote Code Execution (RCE) – CVE-2023-46604

Este repositorio contiene un exploit automatizado desarrollado con fines educativos y de investigación en ciberseguridad, dirigido a demostrar una potencial vulnerabilidad de ejecución remota de código (RCE) en Apache Tomcat (CVE-2025-24813).