13514 matches found
CVE-2026-92593
Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794. The Controller::getPostedRedirectUrl() → View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit introduced a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC token...
CVE-2026-92592
Craft CMS 4.8.0–4.18.5 and 5.0.0–5.10.12 are affected by a remote code execution vulnerability (CVSS 3.1 score 8.8 High ). The root cause is that the HMAC signature for the license-shun cookie is not bound to its purpose—Yii's cookieValidationKey derives from the same Craft securityKey used for s...
CVE-2026-92592 Craft CMS before 4.18.6 Remote Code Execution via signed cookie
Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...
Cisco-CVE-2025-20281-illdeed
CVE-2025-20281 — Cisco ISE ERS API Unauthenticated RCE Exploit This repository contains a Python 3 proof-of-concept exploit for CVE-2025-20281 , a critical vulnerability in Cisco Identity Services Engine ISE that allows unauthenticated remote code execution RCE as root via the ERS API. 🩻...
PoC
PoC Repo for proof of concept exploits and tools. BMCRSCDRCE Unauthenticated remote command execution exploit for BMC Server Automation's RSCD agent. The exploit works against servers affected by CVE-2016-1542 detected by Nessus. This is now a Metasploit module, see...
watchTowr-vs-SonicWall-PreAuth-RCE-Chain
SonicWall SMA 100 PreAuth RCE Chain PoC PoC for SonicWall SMA 100 PreAuth RCE Chain CVE-2023-44221, CVE-2024-38475 See our blog post for technical details https://github.com/user-attachments/assets/b157b39c-d7bd-4385-af7a-e465f8fd4a41 PoC in Action root@kitploit: python...
CVE-2019-11043
CVE-2019-11043 quick and dirty PHP RCE proof of concept...
CVE-2024-52302
CVE-2024-52302: Unrestricted File Upload Vulnerability in Common-User-Management Overview I discovered a critical security vulnerability in common-user-management , a robust Spring Boot application featuring user management services designed to control user access dynamically. This vulnerability...
CVE-2018-8097-PoC
CVE-2018-8097 POC for CVE-2018-8097 This script exploits CVE-2018-8097 and can retrieve files and contents using a time based blind RCE method. Usage root@kitploit: python cve-2018-8097.py -h -u URL -c COMMAND -t TIME -id OBJECTID -d FILEPATH options: -h, --help show this help message and exit -u...
CVE-2026-20340
A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by...
Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467
Apache-OFBiz-Auth-Bypass-and-RCE-Exploit-CVE-2023-49070-CVE-2023-51467 Apache OFBiz is an open source enterprise resource planning system. It provides a suite of enterprise applications that integrate and automate many of the business processes of an enterprise. CVE-2023-49070 is a...
CVE-2020-0022
CVE-2020-0022 vulnerability exploitation on Bouygues BBox Miami Android TV 8.0 - ARM32 Cortex A9 By Polo35 - 2020/08/24 "Usage: python poloexploit.py targetbtmac targetadbip, shellcommand, disablereboot, verbose" Based on scripts by Jan Ruge CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click R...
moltbot-1click-rce
This repository does not have a README...
CVE-2019-9978
CVE-2019-9978 CVE-2019-9978 - PoC RCE in Social WarFare Plugin system'cat /etc/passwd' Save it with filename: payload.txt and upload it on a server. The URI should look like: https://yoursite.com/payload.txt. Finally, supply your --target and --payload-uri options: root@kitploit: $ python...
CVE-2021-22192
CVE-2021-22192 CVE-2021-22192 Range: Unauthorized User RCE Vulnerability 0x10 Range Environment 0x20 Directory Structure root@kitploit: CVE-2021-22192 ├── README.md ............... This README ├── imgs .................... Images for README ├── gitlab .................. Gitlab container mount...
CVE-2026-78839
CVE-2026-78839 Description An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file. Successful exploitation of this issue requires two practical caveats. First, an attacker must either identify an existing form...
react2shell-scanner
react2shell-scanner 一个用于检测使用 React Server Components 的 Next.js 应用中 CVE-2025-55182 和 CVE-2025-66478 的命令行工具。 有关该漏洞及检测方法的技术细节，请参阅我们的博客文章：https://slcyber.io/research-center/high-fidelity-detection-mechanism-for-rsc-next-js-rce-cve-2025-55182-cve-2025-66478 工作原理 默认情况下，扫描器会发送一个精心构造的 multipart POST...
CVE-2026-62997
Kedro-Datasets (data connectors for the Kedro framework) contains a remote code execution vulnerability in its opt-in kedro_datasets_experimental component, specifically the PyTorchDataset class. From version 5.0.0 through 9.5.0 , .pt model files are loaded via torch.load without enforcing weight...
CVE-2026-62997 Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`
Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedrodatasetsexperimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weightsonly=True, and user-supplied loadargs are silently dropped. On PyTorch versions...