Advanced Search

Generic PoC for CVE-2026-34990 - CUPS 2.4.16 Local Privilege Escalation via Local token disclosure and arbitrary root file overwrite.

Technical analysis and proof-of-concept research for CVE-2026-34990, a local privilege-escalation vulnerability affecting CUPS. This repository docum...

CVE-2026-38526 - Authenticated RCE exploit for Krayin CRM = 2.2.x. Upload arbitrary PHP via /admin/tinymce/upload and gain remote code execution. Pyth...

PoC for CVE-2020-13664

Out-of-bounds Write (CWE-787)

Hands-on cybersecurity and CTF labs covering port reconnaissance, CMS stack discovery, VulnCMS, CVE-2026-58225, shell-to-root paths, Python, sudo, use...

Proof-of-Concept for CVE-2026-18110

Originally an access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX with FRITZ!Os v7.59 allowed attackers to obtain sensiti...

CVE-2026-100721 PoC: vm2 3.12.2 NodeVM external allowlist bypass → sandbox escape / host RCE. Local Node lab (evil-left-pad), remote sandbox API mass ...

CVE-2026-88772 - Citrix NetScaler ADC/Gateway DTLS memory overflow (RCE/DoS)

Improper Input Validation (CWE-20) SSVC Scores Exploitation: Active Technical Impact: Total

CVE-2026-93958 PoC: D-Link R95 BE9500 DHMAPI SetTimeSettings NTPServer authenticated root command injection. DHMAPI login, RCE verify, mass bulk explo...

CVE-2026-82384 PoC: Apache Roller 6.1.5 unauthenticated XML-RPC ex:serializable Java deserialization (pre-auth RCE). Check, ysoserial exploit, mass bu...

CVE-2026-85984 PoC: WordPress miniOrange OTP ≤5.5.5 unauth admin bypass (mo_wp_login_intent=otp + empty password). Check/exploit, user enum, colored C...

CVE-2026-78006 + CVE-2026-78159 Mass Exploit

CVE-2026-28695 PoC - Authenticated blind remote code execution in Craft CMS.