Exploits & Tools

CVE-2026-24061

RustFS Hardcoded gRPC Authentication Token Exploit

CVE-2025-67494

Next.js React Server Components RCE exploit

MonstaFTP Unauthenticated File Upload

CitrixBleed 2 (CVE-2025-5777)

CraftCMS RCE Checker (CVE-2025-32432)

Unauthenticated Command Injection In Progress Kemp LoadMaster

Unauthenticated RCE in Palo Alto PAN-OS

CVE-2024-21893 to CVE-2024-21887 Exploit Toolkit

Comprehensive Exploit Chain for Multiple Vulnerabilities in VinChin Backup & Recovery <= 7.2

GeoServer Remote Code Execution

Zimbra - Remote Command Execution (CVE-2024-45519)

Unauthenticated RCE on CraftCMS when PHP `register_argc_argv` config setting is enabled

Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

PAN-OS auth bypass + RCE

VICIdial Unauthenticated SQLi to RCE Exploit (CVE-2024-8503 and CVE-2024-8504)

SPIP BigUp Plugin Unauthenticated RCE

CosmicSting (CVE-2024-34102)

Unauthenticated Remote Code Execution in SPIP versions up to and including 4.2.12

Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

PHP CGI Argument Injection vulnerability

An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.

D-Link NAS CVE-2024-3273 Exploit Tool

Exploit Toolkit for Adobe ColdFusion CVE-2024-20767 Vulnerability

Proof of Concept for Authentication Bypass in JetBrains TeamCity Pre-2023.11.4

RCE in Ivanti Connect Secure

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.

A PoC exploit for CVE-2023-43208 - Mirth Connect Remote Code Execution (RCE)

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

Atlassian Confluence - Remote Code Execution

Ivanti Pulse Secure CVE-2023-46805 Scanner - Based on Assetnote's Research

This repository presents a proof-of-concept of CVE-2023-7028

Apache OfBiz Auth Bypass Scanner for CVE-2023-51467

Exploit for the unauthenticated file upload vulnerability in WordPress Royal Elementor Addons and Templates plugin (< 1.3.79)

Sensitive information disclosure in NetScaler ADC

CVE-2023-22515: Confluence Broken Access Control Exploit

SPIP Vulnerability Scanner - CVE-2023-27372 Detector

WAGO Remote Exploit Tool for CVE-2023-1698

CVE-2023-30943 vulnerability in Moodle

Automated vulnerability scanner for CVE-2023-28432 in Minio.

Citrix ADC RCE CVE-2023-3519

Remote Code Execution on Junos OS CVE-2023-36846

CloudPanel 2 Remote Code Execution Exploit

CVE-2023-38035 Recon oriented exploit, extract company name contact information

Remote Unauthenticated API Access Vulnerability in MobileIron Core 11.2 and older

Remote Code Execution on Metabase CVE-2023-38646

Authenticated OS command injection vulnerability (CVE-2023-33617)

pfBlockerNG <= 2.1.4_26 Unauth RCE (CVE-2022-31814)

PoC for CVE-2022-39952 affecting Fortinet FortiNAC.

Bash Script for Checking Command Injection Vulnerability on CentOS Web Panel [CWP] (CVE-2022-44877)

DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor Website Builder plugin <= 3.5.5 versions.

CVE-2022-26134 - Pre-Auth Remote Code Execution via OGNL Injection

Fortinet Critical Authentication Bypass Vulnerability (CVE-2022-40684)

CVE-2022-1388 | F5 - Big IP Pre Auth RCE via '/mgmt/tm/util/bash' endpoint

PoC exploit for CVE-2022-36804 (BitBucket Critical Command Injection)

Python Script to exploit Zimbra Auth Bypass + RCE (CVE-2022-27925)

Python script to exploit CVE-2022-22954 and then exploit CVE-2022-22960

Python script to exploit CVE-2022-29464

Python script to exploit CVE-2022-29303

Simple python script to exploit CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection

Telesquare SDT-CW3B1 1.1.0 - OS Command Injection

Python script to exploit CVE-2021-35064 and CVE-2021-36356

Apache 2.4.49 RCE

FreeSWITCH Exploit (CVE-2019-19492)

A PoC exploit for CVE-2017-8225 - GoAhead System.ini Leak

PHPUnit RCE

A fast WordPress plugin enumeration tool

LeakIX API Client (Unofficial)

Qdrant ToolKit - Navigate and dump data from Qdrant vector databases

Read PostgreSQL data files without credentials - forensics, data recovery, and security research tool

An interactive Docker client for exploiting misconfigured Docker sockets and remote endpoints

CyberPanel v2.3.6 Pre-Auth RCE Exploit Tool