Advanced Search

Writeup + CVE analysis + countermeasures for the Hacktivity 'Vulnerabilities, Exploits, and Remote Access Payloads' lab (netcat shells, Metasp...

HTTP exploit server for Safari browsers

CVE-2026-55040

A Python-based exploitation framework for CVE-2026-75604 that enables authorized penetration testers to validate Next.js Windows cache traversal vulne...

Hack The Box Nexus machine write-up covering reconnaissance, Gitea credential discovery, Krayin CRM exploitation via CVE-2026-38526, initial access, a...

Zimbra SNMP Notification OS Command Injection — Unauthenticated RCE via SMTP exploit (Poc)

Detector + root-cause analysis for CVE-2026-72898 (Metabase unauthenticated SQLi via reset_password)

POC pre-auth RCE on Sharepoint chain

Poc CVE-2026-18080

PoC for CVE-2026-19632 - TranslatePress – Multilingual = 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

Proof-of-concept kernel exploit for GhostLock (CVE-2026-43499) on the Infinix Hot 70.

PoC for CVE-2025-2945 — pgAdmin 4 authenticated eval() injection RCE, CVSS 9.9

CVE-2026-56705 — Adminer 5.4.3 Unauthenticated RCE via MSSQL PDO DSN Injection

CVE-2026-56705 - Adminer 5.4.3 unauthenticated RCE via MSSQL PDO DSN injection (ODBC TraceFile arbitrary file write). PoC, Docker lab and negative te...

PoC for CVE-2026-32475: Elementor Pro =4.2.1 unauthenticated file upload to RCE. Stdlib-only Python.

CVE-2021-41773 Apache HTTP Server 2.4.49 Path Traversal to RCE Exploit

CVE-2026-68820 — Mass Exploit Framework Edition.

A fuel CMS exploit based on Python for RCE mentioned in CVE-2018-16763.

PoC, Dockerfile playground and root cause from patch diff analysis.