bikini/exploitarium

What it is

bikini/exploitarium is a single GitHub repo consolidating one researcher's proof-of-concept vulnerability writeups. The summary names roughly eight targets and says "and more"; the page actually enumerates the full inventory, which is the reason to read further — an engineer can check whether their own software appears.

The page lists these direct entries (self-contained folders tracked by this repo's history): c-ares-tcp-uaf-calc-poc, curl-smtp-expn-recipient-crlf-injection, discord-activity-stock-client-rce-poc, discourse-scoped-api-key-preauth-bypass, ffmpeg-rasc-dlta-calc-poc, firefox-152.0.5-backup-nss-rce-poc, firefox-152.0.6-stock-page-native-calc-poc, firefox-smartwindow-private-url-exfil-poc, floci-apigateway-vtl-rce-poc, gogs-admin-csrf-git-hook-rce-poc, ladybird-wasm-esm-host-function-rce-poc, libarchive-zip-debuginfod-size-boundary, libssh2-cve-2026-55200-poc, libssh2-publickey-list-calc-poc, nextcloud-federated-share-bearer-token-poc, nextjs-unstable-cache-object-argument-collision, nodebb-activitypub-attributedto-local-uid-spoof-poc, nghttp2-nghttpx-upgrade-queue-poison-poc, nmap-ipv6-extlen-wrap-poc, openssh-agent-lock-provider-bypass, php857-streambucket-soap-rce-rpoc, pillow-imagecms-output-mode-oob-poc, postgres-ri-owner-switched-cast-poc, qemu-cxl-type3-mailbox-escape-poc, redis-vset-duplicate-hnsw-id-rce-poc, rustdesk-session-permission-pocs, and systeminformer-phsvc-trusted-host-lpe-poc.

Only one CVE id is stated on the page: CVE-2026-55200 (libssh2). The other folder names describe bug classes, not assigned CVEs.

Provenance / integrity

The consolidation is not a loose copy. On June 23, 2026, the author verified each former standalone repo's HEAD tree against the matching folder here using Git tree data, requiring identical relative path, Git object type, tree mode (including executable bits), and Git blob ID for every entry. Matching blob IDs mean the tracked file bytes are identical. The check covered 12 repos and 96 tracked entries with zero mismatches. Repository-level metadata (stars, issues, PRs, releases, separate Git history) was left in the original repos, not migrated.

Caveats

• The author states the repo "was incomplete when published" — the inventory above may not be final.
• Fuzzing was fully automated with GPT-5.3; the PoCs themselves were hand-typed (RustDesk being AI-assisted), and READMEs are AI-generated but human-reviewed for accuracy. Treat READMEs as second-hand descriptions of the author's own work.
• The objdump OOB-write finding is explicitly conceded to prior work at github.com/4D4J/objdump-Out-Of-Bounds-write, which the author says has a better PoC — go there rather than here for that one.
• No patch links, affected-version ranges (beyond what folder names encode), or mitigation commands are given on this page; each folder's own README would need to be opened for those.