Exploits

CVE-2026-0092- Possible device lock controller bypass due to a missing permission check.

Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting PoC

TryHackMe Moniker Link (CVE-2024-21413) walkthrough: Outlook Protected View bypass leading to NTLMv2 hash capture via a crafted moniker link.

Firmware for getting a power trace of the behavior of the bluetooth module on the ESP32 when the ESP32 is sent the undocumented hci bluetooth commands (CVE-2025-27840). Uses ESP-IDF v5.0.8 and v5.0.9.

Milvus 认证安全检测脚本：CVE-2025-64513 (sourceid后门) / CVE-2026-26190 (/expr弱token) / 内部端口53100

Defensive detection & mitigation tool for CVE-2026-31431 ("Copy Fail") — Linux kernel algif_aead LPE. No exploit code included.

PoC + analysis for CVE-2026-54917 — SeaweedFS S3 gateway cross-bucket path traversal (CVSS 10.0, <4.30). Read/write any bucket via .. in the object key.

ICS-Park Smart Park Management System v2.0

CVE-2023-38831 WinRAR lab: detection with Sysmon/Wazuh, reverse engineering with Ghidra, patch analysis, and remediation.

Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` parameter.

CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE

CVE-2026-67620 - Flowise SSRF via incomplete cloud-metadata deny-list (Oracle OCI 192.0.0.192 + Alibaba 100.100.100.200 bypass the DEFAULT_DENY_LIST)

python code use to check for user in ssh

Splunk SIEM lab simulating and detecting CVE-2021-34527 (PrintNightmare) exploitation using Sysmon, Windows Event logs, and custom SPL detection rules.

GhostLock (CVE-2026-43499) exploit adapted for Honor AAK-AN00 (MagicOS 10, kernel 6.6.89-android15)

GhostLock (CVE-2026-43499) kernel exploit for samsung devices with locked bootloader

Apache HTTP Server 2.4.x mod_lua Buffer Overflow (CVE-2021-44790) - Advanced exploitation framework with fingerprinting, multi-stage scanning, plugin architecture, professional reporting, screenshot capture, SQLite database, and 95%+ confidence detection. Author: Sudeepa Wanigarathna.

Technical analysis and proof of concept (PoC) for CVE-2025-55182 (React2Shell), a critical RCE vulnerability in React Server Components. Includes a Python tool, Docker lab, and documentation for reproduction and validation in authorized environments.