$ ls ~/exploits
exploits
CVEs I turned into working proof-of-concept code — writeup here, full exploit on GitHub.
> Jul 28, 2026
CVE-2026-40901: DataEase 4-bug chain to unauthenticated root RCE
Auth bypass → JDBC blocklist bypass → stacked-query SQLi → Java deserialization in a Quartz job-store BLOB. Four modest bugs in DataEase ≤ v2.10.20 compose into remote code execution as root, with a dockerized lab and a working PoC.
[cve][rce][dataease][deserialization][sqli][poc]
> Jul 25, 2026
CVE-2026-26216: Crawl4AI unauthenticated RCE via hooks
A single unauthenticated JSON POST to Crawl4AI's /crawl endpoint executes Python as root — the homemade builtins sandbox kept __import__ on the allowlist. Dockerized lab plus a stdlib-only exploit.
[cve][rce][crawl4ai][sandbox-escape][poc]
> Jul 20, 2026
CVE-2026-63030: wp2shell — WordPress Core pre-auth REST route confusion → SQLi
A dockerized lab for wp2shell: a REST batch route-confusion bug in WordPress Core 7.0.1 chained with an author__not_in SQL injection to leak user password hashes with zero credentials, driven by a dependency-free Python exploit.
[cve][wordpress][sqli][rce][poc]
> Jul 12, 2026
CVE-2025-55182: React2Shell — RCE in React Server Components
React2Shell — a CVSS 10.0 unauthenticated RCE in the React Server Components deserializer (react-server-dom-*), added to CISA KEV two days after disclosure. Root cause, affected versions, and a working Python PoC.
[cve][rce][prototype-pollution][react][poc]
> Jul 12, 2026
CVE-2025-27515: Laravel file-upload validation bypass — polyglot JPEG/PHP PoC
A PoC lab for CVE-2025-27515: bypassing Laravel's array/wildcard file-upload validation with a JPEG+PHP polyglot to smuggle a webshell past MIME and extension filters, driven by a Python exploit against a vulnerable upload endpoint.
[cve][laravel][file-upload][webshell][poc]
> Jul 12, 2026
CVE-2021-44228: Log4Shell RCE — end-to-end PoC lab
A dockerized Log4Shell lab — vulnerable Spring Boot + Log4j 2.14.1 app, a marshalsec LDAP + HTTP payload server, and a Node.js exploit that drives JNDI injection all the way to remote code execution.
[cve][log4j][rce][jndi][poc]