Exploits

A demonstration of the recent vuln CVE-2025-27152

Windows Error Reporting ALPC Elevation of Privilege (CVE-2026-20817) - Proof-of-Concept exploit demonstrating local privilege escalation via WER service.

Interactive shell client for React Server Components RCE exploitation via __proto__ pollution (CVE-2025-55182)

PoC and explanation for CVE-2025-4517 used in a CTF I was playing.

Tarfile module directory traversal vulnerability ( with overflow crossed Directory ) --> Lead to Privilege escalation

A Python script to generate a malicious tar archive that exploits CVE-2025-4138 / CVE-2025-4517.

A high-performance Python toolkit to automate the CVE-2025-4517 PATH_MAX bypass exploit. Specifically tuned for the WingData HTB challenge to achieve arbitrary file writes and root persistence

Privilege Escalation script for Wingdata

CVE-2025-4138 - Python Arbitrary file write outside extraction directory

Python tarfile data filter bypass via PATH_MAX overflow in os.path.realpath() - CVE-2025-4517 / CVE-2025-4330

[AtHack 2026] Pwn challenge about telnetd CVE-2026-24061

CVE-2025-4517 (CVSS 9.4 – Critical) A vulnerability in Python's `tarfile`

CVE-2025-4138 / CVE-2025-4517 — Python tarfile PATH_MAX Symlink Filter Bypass

CVE‑2025‑4517 Proof‑of‑Concept Script

Домашняя работа по Pyton № 10 CVE-2020-11022 Краткое описание CVE-2020-11022 — уязвимость типа Reflected XSS (межсайтовый скриптинг), связанная с некорректной обработкой пользовательского ввода, который отражается в HTML-ответе без экранирования. Атакующий может внедрить JavaScript-код, который выполнится в браузере пользователя.

A lightweight Docker lab for experimenting with Telnet protocol negotiation, explained in the CVE-2026-24061 exploit, which contains automatic username injection using the NEW-ENVIRON option.

Herramienta avanzada de explotación transversal de ruta de WinRAR para CVE-2025-8088

针对 Next.js 原型污染漏洞 (CVE-2025-55182) 的高效批量检测工具。