Exploits

React2Shell(CVE-2025-55182) 취약점 기반 침해 시나리오를 재현하고, Wazuh/Sysmon/Coraza WAF 로그로 침해사고를 분석·대응한 DFIR 프로젝트

WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload

ipTIME A3004T - Remote Code Execution

D-Link DNS_340L - OS Command Injection

Duplicati 2.2.0.3 - JWT Signing Key Leak

Joomla JCE_2.9.15 - Remote Code Execution

NanaZip 6.5 - DoS

flyto_core 2.26.7 - Server-Side Request Forgery

Probo 0.222.2 - IDOR

webpack_devserver 5.2.5 - CSRF

phpSysInfo 3.4.5 - IP Allowlist Bypass

Nmap 7.99 - Extension Header Integer Underflow

Using CVE-2026-43499 to root your Galaxy S24 Ultra(SM-S9280 ,(China / Hong Kong SAR / Taiwan))

CVE-2026-73678 — MindsDB Minds Platform unauthenticated RCE via scratchpad exec (CVSS 10.0). Verified end-to-end with real LLM

CVE-2026-73633（S2-072）概念验证代码

POC | GeoServer Unauthenticated SQL injection to complete RCE

PoC for CVE-2026-73847 - emlog AI Assistant CSRF to SQL execution to admin takeover (CVSS 6.8)

PoC for CVE-2026-73519 - WolfStack hardcoded cluster secret leads to unauthenticated RCE (CVSS 9.8)