Exploits

CVE-2026-63030 Exploit | by gr1tx

Aimy Captcha-Less Form Guard Joomla Component PHP Object Injection RCE. clfgd XOR keystream recovery + unserialize(). CVSS 10.0 | CWE-502 | aimy_captcha-less_form_guard < 20.1

CVE-2022-24903 Heap-based buffer overflow

Demonstrate the unauthenticated remote code execution vulnerability in the RSFiles! Joomla component through an arbitrary file upload.

DJ-Classifieds Joomla Component Unauthenticated File Upload RCE. 3-string filter bypass via PHP short tags. CVSS 10.0 | CWE-434 | com_djclassifieds < 3.11.2

this is a poc for CVE-2026-33937

JetBrains TeamCity On-Premises CVE-2026-63077 Emergency Hardening & Patch Runbook Package

Security research tool for FortiWeb CVE-2025-64446 vulnerability. Automated exploitation framework with advanced logging, real-time metrics, proxy debugging, and professional reporting. Includes retry logic, multi-threading, and configurable settings. For authorized security testing only. CVSS 9.8 Critical.

Huawei P10 VTR-L29C432B151 CVE-2017-8890 exploit research and bootloader-unlock journey

A critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83.

Single click Remote Code Execution exploit targeting Gajim on devices with KDE Plasma.

Tplink wr841 v10 rce exploit

CVE-2020-7882 - Draft or Todo

Gitea diffpatch RCE

Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environment with Docker and includes a Go-based brute-forcer that cracks the weak mt_rand hash to create an administrator account.

Fastjson RCE

PoC exploits for CVE-2026-52824 (GHSA-jr9p-4h4j-6c58) — Kimai time-tracking default APP_SECRET authentication bypass affecting versions ≤ 2.57.0

CVE-2026-10702