Duplicate Advisory: vm2 contains a sandbox escape vulnerability

PoC: CVE-2026-104748

Unauthenticated privilege escalation in SimpleForm WordPress plugin <= 3.10.0. Registers an administrator account without authentication

PoC: CVE-2026-97229-PoC

GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image

PoC: CVE-2020-25213-exploit

Exploit para explotar la vulnerabilidad CVE-2020-25213 en WPFileManager < 6.9

PoC: AhsayCBS-Auth-Bypass-RCE

A proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS

PoC: CVE-2026-97657

CVE-2026-97657 – Authentication Bypass & Account Takeover | Pocbit

PoC: CVE-2026-109721

Write-up for CVE-2026-109721

PoC: CVE-2026-85097-Toolkit

CVE-2026-85097 – Bricksforge WordPress Plugin Unauth File Upload to RCE Toolkit (CVSS 10.0) | Red/Blue Team suite for Bricksforge Pro Forms < 3.1.8.9. 2 tools: Full Exploit (polyglot upload, web shell, mass scan, OPSEC, SQLite/JSON output) + SafeChecker (version detect, non-intrusive audit). Ethical & educational use only.

PoC: CVE-2026-102489

CVE-2026-102489 exploit in golang

PoC: CVE-2026-104711-POC-NEW-VARIANT

POC for the CVE-2026-104711 - New Variant

PoC: CVE-2026-47644

CVE-2026-47644 ($12,000): Edge Copilot Prompt Injection Leads to Cross-Tab Data Exfiltration - PoC & full writeup

PoC: MOcha

CVE-2023-41991 vulnerability exploitation

PoC: CVE-vulnerability

CVE-2026-0322

PoC: ivanti-cve-2026-104935-check

Detection-only check for the Ivanti Connect Secure authentication bypass (CVE-2026-104935)

PoC: microsoft-security-advisory-cv

Autonomous submission for "Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability" (MSRC / GitHub Security Advisory)

PoC: CVE-2026-107081

SQL Injection via identifier injection in SLiMS 9.8.0 admin AJAX endpoints (tableName/tableFields). Any authenticated staff can dump password hashes.

PoC: CVE-2021-4034

CVE-2021-4034 (PwnKit) - Python PoC

PoC: CVE-2026-76519-POC

Unauthenticated remote code execution on Cisco Secure Email Gateway via crafted email attachment. Path traversal in AMP File Reputation handling allows arbitrary file write as root when the service is enabled on a mail policy.

PoC: CVE-2026-109506

Technical writeup of CVE-2026-109506, a vulnerability I found in multiple TP-Link Wi-Fi Range Extenders

PoC: CVE-2026-104748

CVE-2026-104748 POC

PoC: DirtyFrag

DirtyFrag (CVE-2026-43284) pro Galaxy A57 5G (SM-A576B, A576BXXS6AZI2): gatilho libbase pro One UI 8.5 + dfroot.ko compilado exato pro 6.12.38-android16-5 do aparelho

PoC: CVE-2024-36057

CVE-2024-36057 - Authenticated OS Command Injection in Koha Library Software < 23.05.10 (upload-cover-image.pl). Advisory + PoC by Hacklantic.

PoC: CVE-2024-36058

CVE-2024-36058 - Authenticated Time-Based Blind SQL Injection in Koha Library Software < 23.05.10 (opac-sendbasket.pl). Advisory + PoC by Hacklantic.

PoC: cve-2025-24801-glpi

Reproducible local lab and source analysis for CVE-2025-24801 in GLPI 10.0.16

PoC: CVE-2017-7921

A Python-based tool for security assessment of Hikvision devices affected by CVE-2017-7921.

PoC: DC1-Penetration-Testing-Report

Penetration test report for the DC-1 VulnHub machine: Drupalgeddon2 (CVE-2018-7600) RCE, credential discovery, and SUID privilege escalation to root. Includes CVSS-rated findings and a remediation roadmap.

PoC: CVE-2026-92392

Defensive exposure checker and poc for cURL CVE-2026-92392

PoC: wazuh-unauth-chain

Wazuh PoC chaining CVE-2026-74034 file read and CVE-2026-74041 command execution; fixed in 4.14.8. Python standard library only.

PoC: Heartbleed-CSP-project

Heartbleed (CVE-2014-0160) reproduction and analysis —CSP Application Security project

PoC: linux-kernel-cve-2026-74580-vghost

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

PoC: merkle-lab

针对比特币 Merkle 根算法（含 CVE-2012-2459 变异检测机制）设计并实施自动化测试方案，覆盖功能正确性、边界场景与安全回归。

PoC: CVE-2026-85046

V8 inlined Array.prototype.sort elements-kind confusion - PoC + addrof (N-day research)

PoC: CVE-2025-13224

V8 super receiver confusion - PoC + unreachability research

PoC: CVE-2025-12433

V8 hole-check elision merge bug - PoC + exploit

PoC: CVE-2024-5274

V8 parser x bytecode-flush NativeContext leak - PoC

PoC: CVE-2024-2887

V8 Wasm GC type confusion - two PoCs (kExtern / kNone paths)

PoC: CVE-2024-23222

JSC DFG TOCTOU stale JSCell - deterministic UAF PoCs + race harness

PoC: CVE-2018-4125-4161-4162-4163

JSC side-effect type confusion family (4 CVEs) - family PoC + full exploit

PoC: cve-2026-44825-challenge

cve2026-44825_ctf_test

PoC: CVE-2023-41993

JSC DFG CSE offset-key bug, GetterSetter leak - PoC + exploit

PoC: CVE-2023-2033

V8 TheHole leak - PoC

PoC: CVE-2022-1364

V8 escape-analysis object materialization confusion - PoC

PoC: CVE-2021-38003

V8 TheHole leak via JSON.stringify - PoC + OrderedHashMap amplification

PoC: CVE-2021-30517

V8 SuperIC confusion - PoC + addrof/fakeobj/arb-rw exploit snippets

PoC: CVE-2019-0567

ChakraCore InitProto type confusion - PoC

PoC: CVE-2026-104711-POC---Brand-New

CVE-2026-104711 POC - Brand New

PoC: BLU_G35

A self-contained Linux kit for BLU G35 (Unisoc SC9863A): unlock the bootloader via the publicly documented CVE-2022-38694 BootROM method, insure first with three cross-verified backups, gate every write behind typed consent, and roll back to full box state. Security research — read the pinned issue before running anything.

PoC: CVE-2026-85097

For WordPress

PoC: CVE-2021-21413

CVE-2021-21413 isotaled-vm Sandbox Escape PoC

PoC: CVE-2026-110025

CVE-2026-110025: bilingual analysis and safe local PoC for phpwcms unrestricted upload to RCE

PoC: CVE-2026-108924

CVE-2026-108924: didactic PoC for Kirby dynamic option authorization bypass

PoC: factura-malware-analysis-lab

Malware analysis of a malicious RTF document exploiting CVE-2017-11882, done in a REMnux lab with static analysis and shellcode emulation.

PoC: Reflected-XSS-Bludit-CVE-2026-41456

Implementation of varios cross site scripting payloads to exploit CVE-2026-41456

PoC: tmog-rapl-gate

Let Task Manager TMOG read RAPL power on Linux only while it runs — no permanent udev grant (CVE-2020-8694)

PoC: CVE-2026-85884

CVE-85884 POC

PoC: CVE-2026-104935-Proof-of-concept

Unauthenticated remote code execution in Ivanti Connect Secure (CWE-290, CVSS 8.6)

PoC: CVE-2026-82957

SSRF in Hyperledger FireFly Webhook Subscriptions (CVE-2026-82957)

PoC: CVE-2026-76268

CVE-2026-76268 PoC: Splunk Enterprise SHC Patroni REST unauth RCE — PATCH /config archive_command + POST /restart. Check + mass exploit, OOB POCBIT-76268-OK, CVSS 9.8. https://pocbit.org/pocs/cve-2026-76268

PoC: CVE-2026-86086

Zephyr Project: under embargo until 2026-12-01

PoC: POC-for-CVE-2026-104711---New

POC for CVE-2026-104711 - New

PoC: CVE-2025-41450_poc

Code Of The Day

PoC: CVE-2026-102718

Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length.

PoC: CVE-2026-102827

Command execution and patch bypass of CVE-2026-28291 in git-js.

PoC: telegram-account-takeover-poc

CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows

PoC: CVE-2026-105950

Bilingual PoC and technical analysis for CVE-2026-105950 — Formwork formaction URI sanitizer bypass

PoC: POC-EXPLOIT-CVE-2026-104711

POC EXPLOIT CVE-2026-104711

PoC: CVE-2026-68582-PoC

PoC for CVE-2026-68582 / GHSA-rj9j-8772-4h6c — Vikunja link-share BOLA

PoC: pentest-kioptrix

Test d’intrusion sur Kioptrix Level 1 : exploitation d’une faille Apache/mod_ssl (OpenFuck, CVE-2002-0082) jusqu’à l’accès root, en environnement de laboratoire isolé.

PoC: dymo-id-cve-poc

PoCs for CVE-2026-102262 & CVE-2026-101893 — code execution and XXE in DYMO ID (reported & fixed)

PoC: pentest-metasploitable

Test d’intrusion sur Metasploitable 2 : exploitation de la backdoor vsftpd 2.3.4 (CVE-2011-2523) pour obtenir un accès root sans authentification.

PoC: CVE-2026-72898-metabase

CVE-2026-72898 Metabase Security Tools

PoC: CVE-2026-107159

MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header

PoC: CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE

CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE

PoC: CVE-2026-104711-Advanced-Variant

POC for CVE-2026-104711-Advanced-Variant

PoC: KDSExtract

Exploits CVE-2026-58222 to recover Samba KDS root keys and derive gMSA credentials from a low-privilege domain account.

PoC: CVE-2026-104711-exploit-payload-4

POC for the CVE-2026-104711 new variants

PoC: CVE-2026-104711-POC-Variant3

POC for the CVE-2026-104711 which is a new variant

PoC: CVE-2026-104711

POC for the CVE-2026-104711

PoC: CVE-2026-85097

POC CVE-2026-85097

PoC: CVE-2026-41992-poc

POC for the CVE-2026-41992

PoC: fromagegate

FROMAGEGATE — PoC + detection toolkit for Danfoss AK-SM 8xxA CVE-2025-41450/-41451/-41452 (code-of-the-day auth bypass, alarm-to-mail RCE, nginx config injection). For detection-signature development.

PoC: rails-doubletap-py

Automated Ruby on Rails doubletap RCE (CVE-2019-5418 + CVE-2019-5420) in pure Python, using the ERB#def_module gadget for modern Ruby.

PoC: CVE-2026-3888-PoC

CVE-2026-3888 PoC; discovered by the Qualys Threat Research Unit (TRU).

PoC: CVE-2025-32432-craftcms-rce

Working PoC + debugging writeup for CVE-2025-32432 (Craft CMS pre-auth RCE)

PoC: CVE-2026-84411-reproduction

CVE-2026-84411 root cause notes and a non-destructive probe (RouterOS before 7.24)

PoC: sonicwall-sma-1000-cve-2026-102255

A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.

PoC: smartermail

CVE-2026-104082, CVE-2026-104083, CVE-2026-104084

PoC: CVE-2026-91737

CVE-2026-91737 Chrome renderer RCE PoC (PDFium)

PoC: CVE-2026-102255

CVE-2026-102255 - Draft or TODO

PoC: CraftCMS-CVE-2026-79987

Authenticated RCE exploit for Craft CMS 5.9.0–5.10.12 (CVE-2026-79987). Time-based save-action oracle + raw-TCP exfil. Verified on vanilla lab.

PoC: kgsl-1905-msm8953

Research notes & harnesses: KGSL SVM use-after-free (CVE-2021-1905) on Qualcomm MSM8953 / Adreno 506 / kernel 3.18 armv7. Credits upstream patches and prior art.

PoC: CVE-2026-107692

Unencrypted JWT Transmission in War Thunder's Initial Client-Server Handshake

PoC: postgres-basebackup-symlink

PostgreSQL 18.6 - High - Remote - File write - pg_basebackup follows absolute tar symlink leftover of CVE-2026-6475

PoC: CVE-2026-103889

Proof of concept and isolated Docker lab for CVE-2026-103889, an unauthenticated RCE vulnerability in Expivi 3D Product Configurator for WooCommerce ≤ 2.16.2.

PoC: CVE-2026-9586_POC_EXPLOIT

For new CVEs without existing/working/non-mangled POCs

PoC: CVE-2026-91136

CVE-2026-91136 Divi Plus <= 2.4.0 unauthenticated arbitrary file read (mass scanner + exploit)

PoC: langflow-cve-2026-9198

Independent reconstruction, lab validation, and PoC for CVE-2026-9198, the Langflow unauthenticated RCE (fixed in 1.10.1)

PoC: metabase-cve-2026-72898

Independent reconstruction, lab validation, and PoC for CVE-2026-72898 — Metabase unauthenticated SQLi (patched in 0.63.5)

PoC: CVE-2026-15748

Unauthenticated RCE in WordPress Forminator Forms <= 1.56.1 (CVSS 9.8)

PoC: CVE-2026-104286-PoC

PoC CVE-2026-104286 FortiMail

PoC: ReactorWriteUp-HackTheBox

Reactor es una máquina Linux fácil vulnerable a CVE-2025-55182 (React2Shell), RCE sin autenticación en React Server Components. Accedemos como node, crackeamos un hash MD5 de una base de datos SQLite y pivotamos a engineer por SSH. La escalada abusa del flag --inspect de Node.js para ejecutar código como root vía depuración V8.