Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.

PoC: CVE-2026-116296

Gitea archived repository write-protection bypass — milestones, releases and labels unprotected (CVE-2026-116296)

PoC: NODE2SHELL

Read-only Node2Shell detection for CVE-2026-111497 using verified Node.js artifact identities.

PoC: PHP2SHELL

Evidence-based PHP2Shell assessment for CVE-2026-109618 and CVE-2026-109619.

PoC: GhostLock-CVE-2026-98260

基于ghostlock-app与CVE-2026-98260漏洞开发的提权项目

PoC: cve-2020-5902

by yora cve-2020-5902

PoC: CVE-2021-3156

Baron Samedit (CVE-2021-3156): sudo heap-based buffer overflow giving local root. PoC packaged with a static/musl launcher so it runs against older-glibc (2.31) targets.

PoC: php-secure-patch

Bash toolkit that finds and fixes PHP CVEs — PHP2Shell (CVE-2026-109618/109619), CVE-2026-115560, CVE-2024-4577, CVE-2019-11043 — on Linux and macOS. Detects runtimes, audits config, applies source patches, hardens php.ini / FPM / nginx / Apache, hunts compromise, rolls back cleanly. MIT.

PoC: CVE-2026-98260-IQOO-13

Temporary root for the Vivo iQOO 13 via CVE-2026-98260 posix-cpu-timer UAF, with KernelSU and FinaSU late-load

PoC: cve-2026-98432-mitigation-rpm

RPM package that applies an nftables mitigation for CVE-2026-98432 (RHSB-2026-016) on EL 8/9/10

PoC: CVE-2021-43798

CVE-2021-43798 – Grafana (8.0.0-beta1–8.3.0) arbitrary file read PoC

PoC: CVE-2026-98260-for-OPD2501

A CVE-2026-98260 adapt for OPPO Pad Air 5

PoC: Poc-exploit-for-CVE-2026-116779-FreeSWITCH-

🚨 CVE ID: CVE-2026-116779 📦 Product: FreeSWITCH 💉 Type: Command Injection (via SIP MESSAGE) 🔥 Score: 9.8 (Critical(RCE)) +20K target

PoC: SWITCH2-WEBKIT-JAILBREAK

Switch 2 WebKit jailbreak research: CSSFontFace UAF (CVE-2026-43715) primitives + fs escalation path + launcher

PoC: CVE-2026-109618-PHP2SHELL

SAHMSEC classroom lab for CVE-2026-109618(PHP2SHELL)

PoC: laravel-type-juggling-auth-bypass

Simulasi type juggling & implicit type conversion CVE-2026-114509 pada query autentikasi

PoC: CVE-2023-30861-flask-lab

Educational Docker lab reproducing CVE-2023-30861 (Flask session cookie disclosure via missing Vary: Cookie), with exploit, patch verification and a full write-up

PoC: CVE-2026-98260-iQOO-Neo9-Pro-Root

基于CVE-2026-98260的iQOO Neo9 Pro 临时Root实现，AwA

PoC: CVE-2026-19971_guest

LB-LINK WR1210M (CVE-2026-19971) 未授权配置泄露漏洞与访客网络扩展攻击链分析

PoC: drop-ipv4-opt

XDP program to mitigate CVE-2026-98432

PoC: brotli-decoder-overflow

Analysis of buffer overflow in Google Brotli decoder (CVE-2026-111497)

PoC: CVE-2026-63765

PoC exploit for CVE-2026-63765 — Chatwoot < 4.16.0 unauthenticated arbitrary file write via ActiveStorage Direct Upload

PoC: php56-php2shell-rpm

PHP 5.6.40 RPM packages with PHP2Shell security patches for CVE-2026-109618 and CVE-2026-109619 on EL6.

PoC: xboard-core

Xboard 节点后端：基于 Xray-core v26.10.31，单补丁实现设备数/限速，严格对齐 Xboard V2 契约，内置 CVE-2026-98432 缓解

PoC: CVE-2026-107406

Citrix NetScaler RCE/DoS CVE-2026-107406

PoC: poc-CVE-2026-98258

Proof-of-Concept for CVE-2026-98258.

PoC: log4shell-audit-18

Log4Shell (CVE-2021-44228) security audit and remediation tracking

PoC: log4shell-audit-17

Log4Shell (CVE-2021-44228) security audit and remediation tracking

PoC: log4shell-audit-16

Quarterly security briefing research and tracking for Log4Shell (CVE-2021-44228) remediation.

PoC: log4shell-audit-15

Quarterly security briefing research and tracking for Log4Shell (CVE-2021-44228) remediation.

PoC: log4shell-audit-14

Quarterly security briefing notes and remediation tracking for Log4Shell (CVE-2021-44228).

PoC: log4shell-audit-20

Log4Shell (CVE-2021-44228) security audit and remediation tracking

PoC: log4shell-audit-2025

Quarterly security briefing notes and remediation tracking for Log4Shell (CVE-2021-44228) and related Log4j 2 vulnerabilities.

PoC: log4shell-audit2

Quarterly security briefing audit notes for Log4Shell (CVE-2021-44228) and remediation tracking.

PoC: log4shell-audit-followup

Log4Shell (CVE-2021-44228) security research notes and remediation tracking

PoC: CVE-2026-115965

CVE-2026-115965

PoC: PROTECTION2Shell

Dependency-free toolkit that contains, patches and verifies the *2Shell families: PHP2Shell (CVE-2026-109618/109619), HTTP2Shell/Brotli (CVE-2026-111497), CVE-2024-4577, CVE-2019-11043. Cuts exploitation channels at the edge in minutes, applies verified upstream source patches, recycles workers, then re-checks every fix. Unattended: setup.sh --auto

PoC: wsftp-server-scanner

Detection-only local triage scanner for Progress WS_FTP Server October 2026 patch batch: CVE-2026-84295 (CVSS 10.0) and 14 more, graded per group against the split 2024.0.6/2025.0.3 vs 2024.0.7/2025.0.4 fix table. No payloads, no remote probing.

PoC: CVE-2026-116521-poc

CVE-2026-116521-poc

PoC: php2shell-2026-incident-analysis

Independent technical analysis of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), covering root cause, disclosure, honeypot evidence, business risk, open-source security governance, and PHP ecosystem resilience.

PoC: CVE-2026-88773

CVE-2026-88773 - NetScaler nsppe 32-bit chunk-size accumulator wrap (HTTP Request Smuggling)

PoC: factorytalk-assetcentre-rce

Research PoC for FactoryTalk AssetCentre HTTP Remoting RCE (CVE-2021-27460 and CVE-2021-27466)

PoC: php-patch-check

Check whether a PHP version is patched against PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Stdlib-only Python.

PoC: php2shell-lab-verification

Defensive lab verification & IR note for php2shell (CVE-2026-109618 / CVE-2026-109619) — patch matrix, mitigation, hunt one-liners. No PoC.

PoC: cve-2026-18649

GStreamer RTP Depayloader Memory Exhaustion Analysis

PoC: WapGuard

Tiny Shizuku app that clears stuck 'SMS of Death' (CVE-2026-58882) WAP Push messages. Material 3 Expressive.

PoC: CVE-2026-112487

macOS revisiond local privilege escalation to root (CVE-2026-112487)

PoC: CVE-2026-120218

CVE-2026-120218: bilingual TypeMill stored XSS analysis and safe SVG/XSLT PoC

PoC: CVE-2026-98432

PoC for CVE-2026-98432 (Linux kernel IPv4 TCP inet_opt/ireq_opt use-after-free, CVSS 9.8): KASAN-verified UAF reproduction in inet_csk_route_req with A/B fixed-kernel control

PoC: debian-cve-2026-98432-fix

One-click kernel security update for CVE-2026-98432 on Debian 12/13.

PoC: CVE-2026-103039

CVE-2026-103039: Gravity Forms <= 3.1.2 PHP object injection to RCE. PoC by NOXCRYPT (noxcrypt-x). gen_payload.php is not included.

PoC: php2shell-ubuntu

Analisa e corrige as vulnerabilidades php2shell do PHP (CVE-2026-109618 e CVE-2026-109619) no Ubuntu

PoC: whatsapp-valleyrat-analysis

WhatsApp-delivered Winos 4.0 / ValleyRAT stager: DLL sideloading, BYOVD Defender kill (CVE-2026-36425), custom C2 protocol on TCP 443, and previously unreported C2 infrastructure.

PoC: CVE-2026-111585

CVE-2026-111585 — TeamViewer Remote-Control Screen Decompression Integer Overflow → Heap Buffer Overflow (PoC, fixed in 15.83, CVSS 8.8). Containerized lab + one-command repro with vulnerable/fixed differential evidence.

PoC: plr110-6.12.38-cve-2026-64560-ksu

Use cve-2026-64560 to root OneOlus ACE 6T

PoC: cve-2026-98432-ebpf

eBPF (XDP/tc) mitigation for CVE-2026-98432 / RHSB-2026-016 - untested draft

PoC: SG-2026-0037

CVE-2026-54523 Kyverno cross-namespace resource generation PoC and exploit

PoC: motogstylus2023-root

Root exploit for Motorola Moto G Stylus 5G 2023 (genevn) via GhostLock (CVE-2026-43499) — locked bootloader, no flashing

PoC: cve-2026-98432-ubuntu-mitigation

Check an Ubuntu host for CVE-2026-98432 and, after you confirm, apply the interim Red Hat RHSB-2026-016 mitigation. Ubuntu 20.04 to 26.10.

PoC: cve-2026-98432-nft-mitigation

Interim nftables mitigation for Linux kernel CVE-2026-98432 (IPv4-options UAF in tcp_v4_syn_recv_sock) as a reproducible agent skill

PoC: php-7.4-cve-2026-docker

PHP 7.4.33 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.

PoC: cve-2026-98432

Stopgap firewall mitigation for CVE-2026-98432 on Ubuntu 16.04/24.04

PoC: quarkus-brotli-audit

Audit statique de l'exposition d'une application Quarkus au décodeur Brotli vulnérable (CVE-2026-111497). Généré avec Claude Code.

PoC: Samba_Fruit_Vuln

CVE-2021-44142 — Samba vfs_fruit heap OOB read/write lab demo (educational)

PoC: CVE-2026-101767

Unauthenticated SQL injection (CVSS 9.8) in the Oracle EBS 12.2.312.2.15 TCF servlet

PoC: php-8.1-cve-2026-docker

PHP 8.1.34 CLI/FPM Docker image with pinned backports for CVE-2026-109618 and CVE-2026-109619, plus updated native libraries. Documented builds, source and patch checksums, focused regression tests, Trivy reports, and non-root defaults. Linux amd64. UNVERIFIED development preview; independent mysqlnd review remains incomplete.

PoC: CVE-2026-63686

CVE-2026-63686 demo

PoC: CVE-2026-100105

Grafana alerting contact point authorization bypass via schema downgrade (CVSS 7.7) — containerized lab, full PoC, plus 2 unreported findings reproducible on 13.2.5

PoC: synipopt

IPv4 SYN with IP options, one lab target per run, for CVE-2026-98432 research. Header-offset parser, regression tests, and a postmortem of a broken auto-exploiter.

PoC: CVE-2026-116244

pgAdmin 4 server mode: libpq answers GSSAPI with the service account's Kerberos credentials (CVE-2026-116244, fixed in v9.19) — containerized lab + PoC

PoC: CVE-2026-116366

PoC for CVE-2026-116366 — ClickHouse Server unauthenticated RCE (brotli v1.2.0 decoder out-of-bounds write): differential detector, weaponized DoS, containerized vulnerable-vs-fixed lab, root-cause analysis

PoC: cve-2026-98432-guard

Temporary mitigation for CVE-2026-98432 on AlmaLinux 8/9/10 and Ubuntu. Not a kernel fix.

PoC: php2shell-lab

Isolated Docker lab for studying PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619.

PoC: fragnesia-scanner

Detection-only local triage scanner for Linux kernel Fragnesia CVE-2026-46300: grade a running or installed kernel against upstream and distro fixed builds. No payloads, no network.

PoC: ddld36-solar-aegis

⛩️☀️ Zero-cost Cloudflare Edge Defense (CVE-2026-109618) + HTTP x402 AI Crawler Monetization. Earn 20% USDC. Landauer Thermodynamics on Base L2.

PoC: CVE-2012-0002

PoC de exploração do CVE-2012-0002 em equipamentos legados com SO já não suportados.

PoC: TryHackMe-OverlayFS---CVE-2021-3493

Here, We go

PoC: CVE-pipeshub

CVE-2026-119712 (CVSS 8.5 High) — PipesHub < 0.10.0 SSRF via image URLs in indexed documents (CWE-918). Verified PoC.

PoC: cve-2026-98432

Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.

PoC: pillow-patched-brotli

Pillow 13.0.0 wheel rebuilt with Brotli 1.2.1 for CVE-2026-111497, until Pillow 13.1.0 ships

PoC: fix_CVE-2026-98432

Ansible playbook to mitigate CVE-2026-98432

PoC: qt-t-shield

QT Analytics — Operation Fire Pole: Free 60-Second Emergency Defense & Reverse-Proxy Shield for PHP2Shell (CVE-2026-109618 / 109619)

PoC: whichphp

Is the PHP in your container image really fixed for PHP2Shell (CVE-2026-109618, CVE-2026-109619)? Finds every PHP build without running the image, with backport-aware verdicts and evidence.

PoC: CVE-2026-118776

Advisory for node-forge ⌯⌲ 53 mill weekly downloads

PoC: CVE-2026-103688

CVE-2026-103688: Checkout Files Upload for WooCommerce < 2.4.0 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).

PoC: CVE-2026-109384

CVE-2026-109384: IvyForms <= 1.5.1 unauthenticated arbitrary file upload to RCE. PoC by NOXCRYPT (noxcrypt-x).

PoC: cve-2026-98432-mitigation

Interim nftables mitigation for CVE-2026-98432, automatic rollback and Russian administrator guide. Not a kernel patch.

PoC: ntu-se6013-nextjs-auth-bypass

NTU SE6013 Software Security: Next.js CVE-2025-29927 group project. Maintainer-reviewed fork-and-PR contributions.

PoC: cve-2026-98432-validation-mitigation

Read-only patch-state and exposure check for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free, CVSS 9.8), with opt-in interim mitigation and exact rollback.

PoC: CVE-2023-43364

Exploit for CVE-2023-43364 | Searchor <2.4.2 - Arbitrary Code Execution

PoC: hidra

Hidra - A12 / iOS 18.7.2 jailbreak research. Kernel entry via AppleJPEGDriver CVE-2026-20687. No public build yet.

PoC: tcp2kaslr

CVE-2026-98432: a plain IPv4 TCP server is vulnerable, MPTCP is not the trigger. Bug trigger, evidence and analysis.

PoC: project2026_20261030_tokengate

Un fichier PHP, zéro dépendance : dit si laravel/framework est encore sous le correctif TokenGuard (CVE-2026-114509). Aucun exploit, aucun réseau.

PoC: php2shell-research-portfolio

PHP2Shell CVE-2026-109618 and CVE-2026-109619 research and isolated RCE lab

PoC: CVE-2026-104623

PoC and Docker lab for CVE-2026-104623 — SUSE Rancher Manager local-cluster-shell authorization bypass: any authenticated user spawns a shell pod on the management cluster via alternate request forms that dodge the authorization gate. Validated end-to-end on rancher 2.15.2 (vulnerable) vs 2.15.3 (patched).

PoC: CVE-2026-106378

CVE-2026-106378 is a privilege escalation in the Google Chrome sandbox on macOS. An attacker who has already compromised the renderer process can execute arbitrary code **outside the sandbox** via a crafted HTML page.

PoC: cve-2026-6516-scanner

Find ADAudit Plus web servers in nmap output and triage CVE-2026-6516 (pre-auth RCE) in a single dependency-free Python file.

PoC: CVE-aisoc

CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.

PoC: cve-2025-14847-scanner

Unauthenticated MongoDB enumeration, compression enumeration and CVE-2025-14847 triage in a single dependency-free Python file.

PoC: CVE-rapyd-admin

CVE-2026-109566 (CVSS 9.8) — Rapyd Admin 9.0.0 < 9.20.0 hard-coded super-admin credentials via AuthSeeder (admin@laravel / admin). Standalone exploit PoC.

PoC: cve-2026-98432

Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution