Catálogo de exploits

Unauthenticated Arbitrary File Read via Absolute Path

enochgitgamefied/NextJS-CVE-2025-29927-Docker-Lab

🛡️ CVE-2025-31161 - CrushFTP User Creation Authentication Bypass Exploit

fatkz/CVE-2022-24112

pouriam23/CVE-2024-12583

Shuhaib88/Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Proof-of-concept scanner targeting CVE-2024-21762 in FortiOS SSL VPN’s /remote/hostcheck_validate endpoint with reverse shell payload delivery.

Script to exploit Grafana CVE-2025-4123: XSS and Full-Read SSRF

Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

Public disclosure of CVE-2025-31200 – Zero-click RCE in iOS 18.X via AudioConverterService and malicious audio file.

Proof of Concept for CVE-2024-9463

RdBBB3/SHELL-POC-CVE-2022-46169

Exploitation and Post-Exploitation Multitool for Palo Alto PAN-OS Systems affected by vulnerabilities CVE-2024-0012 and CVE-2024-9474

CVE-2021-34527 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare."

eMagicOne Store Manager for WooCommerce <= 1.2.5 - Unauthenticated Arbitrary File Upload via set_image Task

PoC for CVE-2025-47646 - WordPress PSW Front-end Login Registration Plugin ≤ 1.12 Unauthenticated Privilege Escalation

It was determined that malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. # It was determined that only certain operating systems and operating system versions were affected by this vulnerability.

IndominusRexes/CVE-2025-4322-Exploit

HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion (LFI)

CVE-2024-53677

PoC and vulnerability report for CVE-2025-47827.

Automated path traversal testing tool for Grafana plugin endpoints using curl and Bash.

The `swp_debug` parameter in `admin-post.php` allows remote attackers to include external files containing malicious PHP code, which are evaluated on the server. By supplying a crafted URL that hosts a reverse shell payload, an attacker can gain command execution.

Um script automatizado melhorando o exploit do cve-2011-0762 postado no exploit-db

Vulnerabilidad NTLM (CVE-2025-24054) explotada para robo de hashes

Designed for Demonstration of Deep Exploitation.

Mitel MiCollab Authentication Bypass to Arbitrary File Read

Eventin <= 4.0.26 - Missing Authorization to Unauthenticated Privilege Escalation

CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation (CVE-2025-31201), and allowed token theft until patched in iOS 18.4.1 (Apr 16, 2025).

Automation Exploit