🧰 exploit.py

The items that name it 4

• CVE-2026-41940: cPanel & WHM Pre-Auth RCE — Two Write Paths, One Filter
  writeup2026-05-01

  Single-file, stdlib-only (~250 lines) PoC/detection script implementing steps 1-4 of the exploit chain: mints a preauth session, drops the CRLF payload, triggers promotion, and reads back the target's cPanel version via json-api/version to confirm the auth bypass

• Chocapikk/CVE-2026-21858
  repo

  PoC exploit script (run via 'uv run python exploit.py') implementing the full chain: arbitrary file read, admin token forge, and RCE against n8n, supporting --read, --cmd, and interactive shell modes.

• CVE-2026-26980 — Ghost CMS Content API unauthenticated blind SQLi lab
  repo

  Python PoC script that sets up Ghost, verifies the boolean blind SQLi oracle, and extracts data (admin email, password hash, API key) from the Content API

• CVE-2026-42533 nginx heap buffer overflow PoC (pre-auth RCE via two-pass capture clobbering)
  repo

  Full exploit chain (leak → spray → overflow → RCE) for CVE-2026-42533