wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.
Academic proof-of-concept demonstrating CVE-2025-14847 for authorized security research.
CVE-2026-70559
Academic proof-of-concept demonstrating CVE-2026-21445 [LangFlow] for authorized security research.
🛠 Exploit the CVE-2025-14847 vulnerability in MongoDB to disclose sensitive heap memory using a Python script that analyzes responses for new leaked data.
Academic proof-of-concept demonstrating CVE-2026-46442 for authorized security research.
Security research and authorized testing PoC for a Metabase zero-day vulnerability. Intended for defensive research, detection development, and use in controlled lab environments.
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code
Academic proof-of-concept demonstrating CVE-2026-15583 for authorized security research.
Add a description, image, and links to the codeb0ss topic page so that developers can more easily learn about it.
To associate your repository with the codeb0ss topic, visit your repo's landing page and select "manage topics."