CVE-2019-16278

CVE-2019-16278 A simple and quick python script to exploit CVE-2019-16278 Nostromo 1.9.6 from a Directory Traversal vulnerability in the function httpverify in Nostromo nhttpd that leads to unauthenticated RCE via a crafted HTTP request. Only takes in host and port of web server as required...

OMIGOD_cve-2021-38647

OMIGODcve-2021-38647 CVE-2021-38647 es una vulnerabilidad de RCE sin autenticación que afecta al agente OMI como root. Al ejecutar el payload Cambia el HOST Comando: reemplaza tu comando con Comando aquí. como id, whoami, etc. Créditos https://github.com/horizon3ai/CVE-2021-38647 Síguenos...

CVE-2024-25600

CVE-2024-25600 Unauthenticated Remote Code Execution – Bricks Usage: python3 bricks.py Example: python3 bricks.py https://example.org reference: https://github.com/Chocapikk/CVE-2024-25600...

liferay-ga4-rce-research

Liferay CE 7.0.3 GA4 — Vulnerability Research RAPTOR Loop-Hunt A security audit of Liferay Portal CE 7.0.3 GA4 git tag 7.0.3-ga4, commit b2d7cc68a performed with the RAPTOR loop-hunt methodology: deterministic recon → 25 isolated generator agents reading raw source → 22 independent judge agents...

CVE-2026-22200

CVE-2026-22200: osTicket PDF File Read + CNEXT RCE Proof of concept exploit for osTicket CVE-2026-22200 which abuses PHP filters to exfiltrate files through the mPDF library and can be chained to RCE via CVE-2024-2961 CNEXT. Blog Post Deep-dive here: Horizon3.ai - Ticket to Shell: Exploiting PHP...

CVE-2019-2890

CVE-2019-2890 WebLogic Deserialization RCE Vulnerability 0x01 Download SerializedSystemIni.dat /root/Oracle/Middleware/userprojects/domains/basedomain/security root@kitploit: root@159475444bab:/Oracle/Middleware/userprojects/domains/basedomain/security md5sum SerializedSystemIni.dat...

CVE-2021-34371.jar

CVE-2021-34371.jar CVE-2021-34371.jar de https://github.com/vulhub/vulhub/tree/master/neo4j/CVE-2021-34371/rhinogadget USA EXP...

wp2shell-scan

wp2shell-scan A scanner and proof-of-concept toolkit for CVE-2026-63030 wp2shell, a pre-authenticated remote code execution vulnerability in WordPress core Features Two non-destructive detection methods: --check-type time-based SLEEP timing and --check-type error-based TRUE/FALSE/broken...

CVE-2023-22884-Airflow-SQLi

PoC de inyección SQL en Apache Airflow CVE-2023-22884 PoC para CVE-2023-22884 es una vulnerabilidad RCE de Apache Airflow que afecta a versiones anteriores a 2.4.0. La descripción del informe oficial dice: Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales utilizados en un Comand...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...

CVE-2011-2523

vsftpd 2.3.4 Backdoor Exploit FTP Server: vsftpd Vulnerable version: 2.3.4 CVE: CVE-2011-2523 Vulnerability: Backdoor on port 6200 opened when user entered strings appending : in ftp USER param Notes: The RCE doesn't need to be authenticated...

CVE-2024-7954

CVE-2024-7954 Este exploit intentará ejecutar comandos del sistema en objetivos SPIP CVE-2024-7954. Visión general Esta es una herramienta de escaneo y explotación masiva para CVE-2024-7954: SPIP 4.2.8 permite a atacantes no autenticados lanzar RCE en objetivos SPIP. Esta herramienta está basada ...

CVE-2026-60004-POC

CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9.8 root@kitploit: ┌──────────────────────────────────────────────────────────────┐ │ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 CRIT │ │ diffpatch → git hook injection │ v1.17–1.27.0 affected │...

CVE-2026-52199

CVE-2026-52199 : Ejecución Remota de Código no Autenticada en Router 4G UZ801 Resumen de la Vulnerabilidad Existe una vulnerabilidad crítica de Control de Acceso Incorrecto en el Router 4G LTE UZ801v2.1 OEM Genérico Firmware V3.4.3. El dispositivo expone indebidamente un daemon de Android Debug...

CVE-2019-8942

CVE-2019-8942 y CVE-2019-8943: RCE en WordPress privilegio de autor Resumen CVE-2019-8942 es una vulnerabilidad que explota un fallo LFI combinado con la funcionalidad de carga de archivos File Upload para lograr RCE en el servidor web de WordPress con privilegios de autor. Las versiones de...

CVE-2018-16763

Exploit CVE 2018-16763 Introducción PreAuth-RCE en FUEL CMS 1.4.1 Demo Referencias: https://nvd.nist.gov/vuln/detail/CVE-2018-16763 https://www.exploit-db.com/exploits/47138...

cve-2021-1647

CVE-2021-1647 Vulnerabilidad de ejecución remota de código en Microsoft Defender INFO Contraseña:infected...

spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header root@kitploit: spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" build root@kitploit: wget...

spring-spel-0day-poc

spring-spel-0day-poc POC y EXP de RCE para spring-cloud/spring-cloud-function https://github.com/spring-cloud/spring-cloud-function cabecera root@kitploit: spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" compilación root@kitploit: wget...

CVE-2023-6702

Chrome Renderer 1day RCE via Type Confusion in Async Stack Trace CVE-2023-6702 Summary This vulnerability allowed a remote attacker to execute arbitrary code inside the Chrome renderer process. There was an insufficient type check in the async stack trace handling code. It leads to a type confusi...