Exploits

Log4Shell (CVE-2021-44228) research report — technical breakdown, root cause analysis, and end-to-end lab-reproduced exploit chain with evidence screenshots.

TryHackMe Dirty Frag (CVE-2026-43284) — Linux LPE writeup

VMware vCenter Server CVE-2021-21972 (RCE) — vulnerability analysis, detection, and mitigation

CVE-2026-9806 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting CTI Transmute versions prior to the patched release.

Jailbreak supported Google Pixel phones with CVE-2026-43499

CVE-2026-39987 poc

CVE-2025-48932 - Unauthenticated SQL injection exploit for Invision Community ≤ 4.7.20. Fully automated exploitation with database enumeration, credential dumping, admin takeover, session hijacking & multi-threading. No dependencies required. Security research tool by Sudeepa Wanigarathna

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

WordPress CVE-2026-63030 and CVE-2026-60137 security tool for detecting exposure to the WP2Shell pre-authentication RCE chain.

Python implementation/PoC for CVE-2024-40422. Exploits a critical directory traversal vulnerability in Devika v1's /api/get-browser-snapshot endpoint to read arbitrary system files.

GitHub Actions workflow sandbox for CVE-2025-55192 reproduction

Simple POC for CVE-2026-39987

CVE-2026-9809 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

CVE-2026-9811 is a Stored Cross-Site Scripting (Stored XSS) vulnerability affecting Mautic 7 (versions 7.0.0 through 7.1.1).

Local privilege escalation via TOCTOU race condition in PackageKit's.

Marimo exploit prior to 0.23.0. Pre-Auth RCE vulnerability via websocket endpoint : /terminal/ws.

A research project on the Log4Shell (CVE-2021-44228) vulnerability.

A flaw in Gitea Open Source Git Server’s approval‑gate logic allows a pull request that originates from a permanent fork to merge without satisfying the repository’s configured approval gates.