Catálogo de exploits

Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182.

React2Shell Vulnerability Verification Script (React2Shell also known as CVE-2025-55182).

Detection for CVE-2025-37164

Control Web Panel <= 0.9.8.1208 (admin/index.php) OS Command Injection Vulnerability • Software Link:

This is a Proof-Of-Concept of CVE-2025-63353

CVE-2025-40602 is a local privilege escalation vulnerability in the appliance management console (AMC) of SonicWall Secure Mobile Access (SMA) 1000 series appliances.

1C-Bitrix <= 25.100.500 (Translate Module) Remote Code Execution Vulnerability

POC for CVE-2025-33053 WebDav Exploit, demonstrating how the vulnerability can be triggered in a real environment. This repository focuses on hands-on exploitation steps, reproducible test cases, and observable impact, helping security researchers and defenders understand the issue and validate fixes.

This repo describes about cve-2021-29447 and a small script for exploiting automatically

Bitrix24 <= 25.100.300 (Translate Module) Remote Code Execution Vulnerability

Proof-of-Concept exploit for CVE-2025-14174 (EUVD-2025-203113) - Memory corruption in ANGLE allowing out-of-bounds access and RCE in web browsers. Reliable on iOS/Android/Windows, including patched systems with incomplete fixes.

KingHacker353/CVE-2025-20393

Cisco is aware of a potential vulnerability.&nbsp; Cisco is currently investigating and&nbsp;will update these details as appropriate&nbsp;as more information becomes available.

Proof of Concept for Authenticated RCE in Crafty Controller

Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'

Script to detect CVE-2025-20393 for Cisco Secure Email Gateway And Cisco Secure Email and Web Manager

Improved poc of CVE-2017-0785 on DS-MDP002

Proof of Concept for Authenticated RCE in Crafty Controller <= 4.6.1

React2shell vulnerable lab (CVE-2025-55182)

Proof-of-concept research tool for CVE-2025-55182, a critical unauthenticated RCE in Next.js App Router caused by server-side object injection in React Server Components and Server Actions, including UTF-16LE WAF evasion techniques.

proof-of-concept mass scanner targeting JetBrains TeamCity instances affected by CVE-2024-27198

Fortinet announced two closely related authentication‑bypass vulnerabilities on 9 December 2025. Both flaws involve improper verification of cryptographic signatures (CWE‑347) in the handling of SAML responses for the FortiCloud SSO login feature.

CVE-2022-0492

This is a python PoC scripts for CVE-2025-24071 which is a vulnerability in Windows File Explorer that allows unauthorized access to sensitive information like NTLM Exposure.

CVE-1999-0678- /doc directory browsable

React2Shell

A proof-of-concept tool for demonstrating the critical React2Shell vulnerability

Quyida to‘liq LAB rejasi: demo-vulnerable app → Python PoC → Metasploit exploit skeleton

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability."

An advanced vulnerability scanner for detecting **CVE-2025-55182** and **CVE-2025-66478** - critical Remote Code Execution (RCE) vulnerabilities in Next.js applications using React Server Components (RSC).