Exploits

CVE-2025-27636 PoC written in Python

PoC for CVE-2026-77578 - Authenticated Arbitrary Local File Read in Xibo CMS

PoC for CVE-2019-18394: unauthenticated full-read SSRF in Openfire <= 4.4.2 FaviconServlet

CVE-2023-6063-PoC Exploit

CVE-2026-41940 PoC - Linux/Termux Compatible Version

SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert <3.9.6; Unauthenticated Privilege Escalation (Forced Password Reset)

Writeup of the Hackthebox Helix machine

CVE-2026-79387-PbootCMS-SQL-Injection

Testing tool for the Mikrotrick exploit (CVE-2026-67276)

No issue for run this exploit.

An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow.

CVE-2026-67401 cPanel & WHM EmailTrack SQL Injection — IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.

poc in python for CVE-2026-67401

FortiClient FortiShield exploit (CVE-2015-5736) for Windows 10 1809

CVE-2026-67401 - Draft or TODO

Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, detection, remediation.

CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 system_server

CVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel