Skip to content

@vulhub The Vulnerabilities Hub

Change the repository type filter

All

    Repositories list

    24 repositories

    • vulhub

      Public
      Pre-Built Vulnerable Environments Based on Docker-Compose
      dockerdockerfiledocker-composevulnerability-environmentvulhub
      Dockerfile
      •
      MIT License
      •4.8k•20k•19•25•Updated Feb 14, 2026Feb 14, 2026

    • vulhub-org

      Public
      Vulhub's homepage
      reactdockernextjsvulhub
      TypeScript
      •10•30•0•6•Updated Feb 5, 2026Feb 5, 2026

    • vulhub-cli

      Public
      A command-line tool for managing Vulhub vulnerability environments.
      consolecommand-linevulhub
      Go
      •0•7•0•0•Updated Jan 31, 2026Jan 31, 2026

    • java-chains

      Public
      Java Vulnerability Exploitation Platform
      javavulnerabilitypayloaddeserialization-vulnerabilityredteamvulhubjavasecuritylog4j-rcejndi-exploitjava-vulnerability
      Dockerfile
      •165•2k•8•0•Updated Jan 6, 2026Jan 6, 2026

    • CVE-2017-1000353

      Public
      jenkins CVE-2017-1000353 POC
      Java
      •62•56•0•1•Updated May 21, 2025May 21, 2025

    • rocketmq-attack

      Public
      A command-line tool for testing RocketMQ vulnerabilities.
      kotlinexploit
      Kotlin
      •
      MIT License
      •0•13•1•0•Updated Feb 7, 2025Feb 7, 2025

    • evil-ipp-server

      Public
      A evil IPP server to reproduce CVE-2024-47177
      Python
      •
      BSD 2-Clause "Simplified" License
      •36•7•0•1•Updated Sep 28, 2024Sep 28, 2024

    • metersphere-plugin-Backdoor

      Public
      This is a backdoor project for MeterSphere, do not use it in production environment!!! Forking from <https://github.com/metersphere/metersphere-plugin-DebugSamp…
      Java
      •0•7•0•0•Updated Aug 18, 2023Aug 18, 2023

    • openfire-fastpath-plugin

      Public
      This is a evil openfire plugin, do not install it if you don't know what it is
      JavaScript
      •13•0•0•0•Updated Jun 18, 2023Jun 18, 2023

    • JNDIExploit

      Public
      A malicious LDAP server for JNDI injection attacks
      Java
      •379•52•0•0•Updated Apr 29, 2023Apr 29, 2023

    • java

      Public
      Java every minor versions.
      Dockerfile
      •35•74•0•2•Updated Apr 19, 2023Apr 19, 2023

    • cve-2022-0778

      Public
      Go
      •6•0•0•0•Updated Apr 7, 2022Apr 7, 2022

    • yaml-payload

      Public
      Java
      •1•0•0•0•Updated Sep 14, 2021Sep 14, 2021

    • vulhub-ui

      Public
      [WIP] a simple UI for Vulhub
      Python
      •4•16•0•2•Updated Jun 10, 2021Jun 10, 2021

    • MetaDockers

      Public
      Responsible for visualization the vulhub and docker
      visualizationdockerdocker-apivulhub
      Python
      •34•128•1•2•Updated Jun 10, 2021Jun 10, 2021

    • discuz7

      Public
      互联网考古，Discuz 7.x
      PHP
      •1•3•0•0•Updated Aug 12, 2020Aug 12, 2020

    • Dockertools

      Public
      Some tools based on docker
      Dockerfile
      •11•24•0•0•Updated Jul 28, 2020Jul 28, 2020

    • Apereo-CAS-Attack

      Public
      WIP: Demo for Attacking Apereo CAS
      Java
      •9•97•0•0•Updated Jul 17, 2020Jul 17, 2020

    • redis-rogue-getshell

      Public
      redis 4.x/5.x master/slave getshell module
      C
      •
      Apache License 2.0
      •54•374•4•0•Updated Feb 3, 2020Feb 3, 2020

    • goahead

      Public
      GoAhead Web Server
      C
      •
      Other
      •154•0•0•0•Updated Nov 22, 2019Nov 22, 2019

    • thinkphp-2.1

      Public
      互联网考古，ThinkPHP2.1带示例和文档完整包
      PHP
      •1•9•0•0•Updated Sep 24, 2019Sep 24, 2019

    • mirrors

      Public
      mirrorsfile
      0•0•0•0•Updated Dec 6, 2018Dec 6, 2018

    • appweb7

      Public
      C
      •
      Other
      •4•0•0•0•Updated May 4, 2018May 4, 2018

    • fckeditor

      Public
      FCKEditor 2.4.3
      JavaScript
      •
      GNU General Public License v2.0
      •7•0•0•0•Updated May 18, 2016May 18, 2016