Collecting public vulnerability PoCs and research notes to help beginners enter security research
This repository is an archive that consolidates the author's published proof-of-concept (PoC) code and research records. Each folder contains code and explanations demonstrating vulnerabilities in specific software, most of which are preserved directly from repositories the author previously uploaded separately. The author stated that the purpose of this material is to encourage people to take an interest in the field of security research.
AI-assisted fuzzing workflow and manual verification
The author automated the fuzzing (automated vulnerability discovery) process using GPT-5.3. They explain that a state-of-the-art model is not necessary if an efficient workflow is in place, as complex thought processes are not required. However, the actual PoC code was not written by AI but typed directly by the author, with the exception of RustDesk-related code, for which AI assistance was sought due to unfamiliarity with the language. The README file was written by AI but reviewed by the author for accuracy. Additionally, the findings related to objdump were made by another researcher first, and credit was given to that researcher.
List of included vulnerability research
The repository includes vulnerability PoCs for various software such as 7-Zip, AnyDesk, Firefox, Docker, FFmpeg, Ghidra, Gitea, ImageMagick, OpenSSH, Redis, RustDesk, and VLC.
- Consolidated existing repositories It includes 12 existing independent repositories, and file content identity was confirmed by comparing Git tree data.
- Verified integrity 96 tracked items were compared during the consolidation process, and 0 discrepancies were found.
What you must know before using
The materials in this repository were not created for exploitation. The author published all materials for the purpose of good-faith public vulnerability research and strongly warns against cybercrime. Each vulnerability was not officially reported at the time of publication, so readers can report them themselves to receive a CVE number. However, any act of exploiting them is strictly prohibited. This material is an educational archive intended to raise interest in security research and help people enter the field.
