exploit
CorgetGpsDget 2_3.2 - OS Command Injection
OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
Joomla 2.9.99.4 - Unauthenticated Remote Code Execution
Technical vulnerability analysis and CVE briefing for CVE-2026-9645 affecting ScadaBR.
CVE-2026-19195 Proof of Concept
CVE-2026-19193 Proof of Concept
KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499
A Linux kernel local privilege escalation affecting the XFS filesystem copy-on-write (CoW) path.
Root your Galaxy using CVE-2026-43499
A Linux-related vulnerability
Zapscape (CVE-2026-64561) KVM/x86 shadow MMU UAF guest-to-host escape PoC mirror — V4bel/@v4bel, MIT; for authorized security testing
Private research and validation for WebKitGTK file DnD restore (CVE-2025-13947 follow-up)
PoC for CVE-2026-71554 - h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)
PoC for CVE-2026-71554 — h2 duplicate Host header request smuggling primitive (fixed in 4.4.1)
Wormable exploit for CVE-2026-57858
A simple PoC on the Remote Code Execution (RCE) Vulnerability of CraftCMS designated as CVE-2025-32432 written in Go
Advanced React Server Components RCE scanner for CVE-2025-55182. Features: multi-stage fingerprinting, vulnerability verification, DNS exfiltration, interactive shell, payload obfuscation, and professional reporting (JSON/HTML/PDF). Authorized testing only.
Wordpress Pre-auth XSS to RCE exploit PoC (xss2shell & CVE-2026-64638)
PoC funcional de CVE-2026-64638 (XSS2Shell): cadena pre-auth XSS a RCE en WordPress Core. Laboratorio Docker + servidor atacante Python + análisis técnico y mitigación.