Exploit for Deserialization of Untrusted Data in Facebook React

markdown Summary CVE-2025-55182 Scanner is a high-perfor...

Exploit for Stack-based Buffer Overflow in Samsung Exynos_980_Firmware

CVE-2025-54328 — Samsung Exynos SMS RP-DATA Stack Buffer Overf...

Exploit for CVE-2026-31309

CVE-2026-31309: Broken Access Control in Mysterium Node before...

Exploit for Special Element Injection in Rocket.Chat

Rocket.Chat CVE-2021-22911 Exploit ⚠️ DISCLAIMER - EDUCATI...

Exploit for CVE-2026-23869

CVE-2026-23869 - Proof of Concept PoC Description This...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

exploit-CVE-2026-23744 MCPJam Inspector is a local-first devel...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228 — Log4Shell PoC Lab DISCLAIMER Este...

Exploit for CVE-2026-29000

No d...

Exploit for Out-of-bounds Write in Google Chrome

CVE-2026-3909 Chromium Browser PoC This repository contains a...

Exploit for CVE-2026-35584

CVE-2...

Exploit for CVE-2026-5530

CVE-2026-5530 Ollama SSRF via OCI registry redirect with full...

Exploit for CVE-2026-33033

CVE-2026-33...

Exploit for CVE-2026-34197

6.0.0-6.1.1 V...

Exploit for SQL Injection in Djangoproject Django

No d...

📄 WordPress Contact List 3.0.17 Cross Site Scripting

WordPress Contact List plugin versions 3.0.17 and below suffer from a persistent cross site scripting vulnerability. CVE-2026-3516: Authenticated Stored Cross-Site Scripting XSS in Contact List Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The...

📄 MyRewards 5.6.0 Missing Authorization

MyRewards – Loyalty Points and Rewards for WooCommerce versions 5.6.0 and below suffer from a missing authorization vulnerability that allows for privilege escalation. CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce...

📄 WordPress IndieWeb 4.0.5 Cross Site Scripting

WordPress IndieWeb plugin versions 4.0.5 and below suffers from persistent cross site scripting vulnerability. CVE-2025-14893: Authenticated Stored Cross-Site Scripting XSS in IndieWeb WordPress Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. Th...

Paperclip AI RCE using a chain of six API calls (CVE-2026-41679).

Paperclip is the operating system for your AI company. You set the goals, hire AI agents as employees, and watch them plan and execute work. Prior to version 2026.410.0, Paperclip allows for an unauthenticated RCE, tracked as CVE-2026-41679. An unauthenticated attacker can achieve full remote cod...

📄 RomM Cross Site Scripting / File Upload

RomM versions prior to 4.4.1 chained vulnerabilities exploit that leverages file upload to achieve cross site scripting that then leverages csrf token reuse to change a user's password. Exploit Title: RomM Application tab or Storage on Firefox Cookies - Copy the rommcsrftoken cookie value 3...

📄 ZSH 5.9 Remote Command Execution

ZSH version 5.9 proof of concept remote command execution exploit. Exploit ZSH 5.9 - RCE Date: 30-12-2025 Exploit Author: sinanadilrana import pexpect import sys import time def debugprintmsg: printf"DEBUG msg" def returntogdbgdb, maxattempts=3, timeout=3: """More reliable function to return to G...