pocexploitCVE-2022-40684
FortiGate CVE-2022-40684 assessment tool for user enumeration, configuration dump, and lab testing.
Full penetration testing workflow: credential brute force, SSH access and privilege escalation (CVE-2021-4034)
osTicket 1.18.1 Environment (CVE-2026-22200) Lab
Detect, assess, and respond to supply chain attacks across npm/yarn and Python (pip/poetry/uv). Claude Code skill + standalone scripts. Built during axios RAT (2026-03-31) and Starlette BadHost CVE-2026-48710 (2026-05-22).
This repository contains a proof-of-concept (PoC) exploit for CVE-2024-11680, a critical vulnerability in ProjectSend r1605 and earlier versions. The exploit is aimed at incorrect authentication due to problems with incorrect privilege settings and command injection.
Just a simple Rust automation for CVE-2026-29000, design to work against ippsec's Principal box on HackTheBox
ComfyUI-Manager Remote Code Execution exploit. Covers CVE-2025-67303 (config file exposure) and CVE-2026-22777 (CRLF injection). Includes Python script, Nuclei template, and evil git server.
Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a crash of the Python interpreter via a crafted .keras
CVE-2026-33937 Handlebars RCE exploit PoC (AST Injection)
BOLA/IDOR vulnerability in osTicket ajax.tickets.php | Responsible Disclosure
Python PoC and Nuclei template for CVE-2026-21643 (Pre-Authentication SQL Injection in FortiClient EMS 7.4.4)
Static analysis of the DarkSword iOS WebKit exploit chain — delivery, staging, and CVE breakdown (CVE-2025-31277, CVE-2025-43529)
Conducted a full SOC investigation into a Conti ransomware compromise of an Exchange server using Splunk 8.2.2. Analysed 28,145 events across Windows Security, Sysmon, and IIS log sources to reconstruct the complete attack chain. Identified three exploited CVEs (CVE-2020-0796, CVE-2018-13374, CVE-2018-13379), located a trojanised cmd.exe
Python port of the Linksys tmUnblock.cgi RCE exploit
PoC exploit for CVE-2025-34282 - ThingsBoard SSRF via SVG Image Upload
I Found a Zero-Day Vulnerability in langchain — Here’s How It Went
RCE RESPONSIVE filemanager v.9.14.0