ghosttroops/topTOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things
all Top Top Top_Codeql TOP All bugbounty pentesting CVE-2022- POC Exp Things
| star | updated_at | name | url | des |
|---|---|---|---|---|
| 4083 | 2026-11-05T02:14:50Z | copy-fail-CVE-2026-31431 | https://github.com/theori-io/copy-fail-CVE-2026-31431 | Copy Fail (CVE-2026-31431): 9-year-old Linux kernel LPE found by Theori's Xint Code |
| 812 | 2026-11-04T11:36:19Z | wp2shell-poc | https://github.com/Icex0/wp2shell-poc | wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain |
| 1067 | 2026-11-04T19:13:18Z | php2shell-CVE-2026-109618-CVE-2026-109619-PoC | https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC | Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only. |
| 2611 | 2026-11-05T04:19:53Z | ghostlock-app | https://github.com/YuKongA/ghostlock-app | GhostLock One-Tap Execution App (CVE-2026-43499) |
| 984 | 2026-11-04T13:50:56Z | php2shell-scanner | https://github.com/assetnote/php2shell-scanner | High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619) |
| 184 | 2026-10-30T16:06:00Z | next-16.2.4-pocs | https://github.com/dwisiswant0/next-16.2.4-pocs | Next.js v16.2.4 Security PoC Collection (CVE-2026-23870, CVE-2026-44575, CVE-2026-44579, CVE-2026-44574, CVE-2026-44578, CVE-2026-44573, CVE-2026-44581, CVE-2026-44580, CVE-2026-44577, CVE-2026-44576, CVE-2026-44582, CVE-2026-44572) |
| 1005 | 2026-11-04T22:56:48Z | BYOVD | https://github.com/BlackSnufkin/BYOVD | BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501). |
| 576 | 2026-11-04T16:36:55Z | cve_2026_31431 | https://github.com/rootsecdev/cve_2026_31431 | Exploit POC for CVE_2026_31431 |
| 342 | 2026-11-04T01:39:36Z | CVE-2026-54121 | https://github.com/aniqfakhrul/CVE-2026-54121 | Certighost POC |
| 260 | 2026-11-03T15:37:56Z | CVE-2026-43499-popsicle | https://github.com/x-spy/CVE-2026-43499-popsicle | CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k |
| 1579 | 2026-11-05T03:25:48Z | Root-My-Galaxy | https://github.com/BuSung-dev/Root-My-Galaxy | KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499 |
| 234 | 2026-11-02T04:49:11Z | CVE-2026-41089 | https://github.com/0xABCD01/CVE-2026-41089 | Netlogon and CLDAP vulnerability research with a proof of concept. |
| 304 | 2026-11-01T20:42:27Z | CVE-2026-21858 | https://github.com/Chocapikk/CVE-2026-21858 | n8n Ni8mare - Unauthenticated Arbitrary File Read to RCE Chain (CVSS 10.0) |
| 103 | 2026-10-31T00:24:21Z | plex2shell | https://github.com/code-zm/plex2shell | CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656 |
| 291 | 2026-10-29T19:08:06Z | CVE-2026-40369-EXPLOIT | https://github.com/orinimron123/CVE-2026-40369-EXPLOIT | Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox |
| 144 | 2026-11-02T13:17:53Z | CVE-2026-109618-exploit | https://github.com/junaire/CVE-2026-109618-exploit | |
| 209 | 2026-10-19T16:34:56Z | CVE-2026-24061 | https://github.com/SafeBreach-Labs/CVE-2026-24061 | Exploitation of CVE-2026-24061 |
| 163 | 2026-10-24T17:48:39Z | CVE-2026-43499 | https://github.com/MobiusM/CVE-2026-43499 | CVE-2026-43499 PoC |
| 360 | 2026-10-16T09:45:01Z | copyfail-go | https://github.com/badsectorlabs/copyfail-go | A Go implementation of copyfail (CVE-2026-31431) |
| 121 | 2026-10-27T17:20:36Z | wp2shell | https://github.com/0xsha/wp2shell | CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core |
| 192 | 2026-11-04T06:17:15Z | CVE-2026-62911 | https://github.com/hypnguyen1209/CVE-2026-62911 | POC pre-auth RCE on Exchange |
| 490 | 2026-11-05T03:45:34Z | Root-My-Pixel | https://github.com/alex193a/Root-My-Pixel | Jailbreak supported Google Pixel phones with CVE-2026-43499 |
| 491 | 2026-11-04T12:16:13Z | LSPromise | https://github.com/LSPosed/LSPromise | Android complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel, combination of CVE-2026-49881 and CVE-2026-43284 |
| 147 | 2026-11-05T00:47:48Z | CVE-2026-42980-POC | https://github.com/G4sp4rCS/CVE-2026-42980-POC | CVE-2026-42980 PUBLIC EXPLOIT + RESEARCH |
| 509 | 2026-11-03T17:10:21Z | cPanelSniper | https://github.com/ynsmroztas/cPanelSniper | CVE-2026-41940 — cPanel & WHM Authentication Bypass via Session-File CRLF Injection |
| 107 | 2026-11-01T05:19:32Z | CVE-2026-75604-poc | https://github.com/rafabd1/CVE-2026-75604-poc | CVE-2026-75604 Next.js Windows RCE poc |
| 71 | 2026-11-01T15:29:16Z | wp2shell-scanner | https://github.com/ZephrFish/wp2shell-scanner | CVE-2026-63030, CVE-2026-60137, wp2shell scanner |
| 54 | 2026-10-26T22:00:51Z | samsung-android-lpe | https://github.com/Vikramaditya015/samsung-android-lpe | Poc for CVE-2026-20980, CVE-2026-20981, CVE-2026-20982 |
| 80 | 2026-11-05T04:49:12Z | CVE-2026-98260-GhostKey | https://github.com/Again1996-bit/CVE-2026-98260-GhostKey | GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native） |
| 1937 | 2026-11-05T04:04:00Z | php2shell-poc | https://github.com/ikow/php2shell-poc | CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research. |
| star | updated_at | name | url | des |
|---|---|---|---|---|
| 2455 | 2026-11-04T22:03:11Z | react2shell-scanner | https://github.com/assetnote/react2shell-scanner | High Fidelity Detection Mechanism for RSC/Next.js RCE (CVE-2025-55182 & CVE-2025-66478) |
| 1433 | 2026-11-02T22:04:23Z | CVE-2025-55182 | https://github.com/msanft/CVE-2025-55182 | Explanation and full RCE PoC for CVE-2025-55182 |
| 790 | 2026-10-23T08:13:22Z | CVE-2025-55182-research | https://github.com/ejpir/CVE-2025-55182-research | CVE-2025-55182 POC |
| 494 | 2026-11-02T11:17:04Z | CVE-2018-20250 | https://github.com/WyAtu/CVE-2018-20250 | exp for https://research.checkpoint.com/extracting-code-execution-from-winrar |
| 720 | 2026-10-29T00:10:59Z | CVE-2025-33073 | https://github.com/mverschu/CVE-2025-33073 | PoC Exploit for the NTLM reflection SMB flaw. |
| 1005 | 2026-11-04T22:56:48Z | BYOVD | https://github.com/BlackSnufkin/BYOVD | BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE-2026-3609, CVE-2026-8501). |
| 534 | 2026-11-05T01:06:03Z | CVE-2025-32463_chwoot | https://github.com/pr0v3rbs/CVE-2025-32463_chwoot | Escalation of Privilege to the root through sudo binary with chroot option. CVE-2025-32463 |
| 248 | 2026-10-13T19:07:36Z | IngressNightmare-PoC | https://github.com/hakaioffsec/IngressNightmare-PoC | This is a PoC code to exploit the IngressNightmare vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974). |
| 345 | 2026-10-30T02:22:48Z | redis_exploit | https://github.com/raminfp/redis_exploit | CVE-2025-49844 (RediShell) |
| 474 | 2026-10-29T09:25:21Z | CVE-2025-32463 | https://github.com/kh4sh3i/CVE-2025-32463 | Local Privilege Escalation to Root via Sudo chroot in Linux |
