wp2shell-detect

wp2shell-detect Blackbox, non-intrusive detector for wp2shell — the pre-authentication RCE chain in WordPress core disclosed on 2026-07-17: CVE-2026-63030 — route confusion in the REST batch endpoint /wp-json/batch/v1: a sub-request whose path fails wpparseurl lands in the validation array but no...

ROOT-APP-MAVEN-CVE-2026-5795 CVE-2026-5795 in org.eclipse.jetty.ee10:jetty-ee10-jaspi - Patched by Root

Root has patched CVE-2026-5795 in the org.eclipse.jetty.ee10:jetty-ee10-jaspi package for Root:Maven. Multiple fixed versions available...

CVE-2019-16278

CVE-2019-16278 💻 -h3x0v3rl0rd- nostromo 1.9.6 - Remote Code Execution...

CVE-2026-46420

CVE-2026-46420 PoC Command injection in shivammathur/setup-php when the PHP version is loaded from repository controlled files. Affected: root@kitploit: = 2.25.0, = 2.37.1 PoC The target repository already has a vulnerable workflow that checks out pull request contents and runs...

linux-4.19.72_CVE-2020-27815

Linux kernel There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first. In order to build the documentation, use make htmldocs or make pdfdocs. The formatted documentatio...

external_expat_AOSP10_r33_CVE-2022-22822toCVE-2022-22827

Expat, Release 2.2.6 This is Expat, a C library for parsing XML, started by James Clark in 1997. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in...

CVE-2021-24006-Fortimanager-Exploit

CVE-2021-24006 – FortiManager Improper Access Control Exploit PoC PoC Proof of Concept - Educational Use Only Exploit for improper access to SD-WAN Orchestrator in FortiManager, exploiting access control flaw CWE-284. Description The CVE-2021-24006 vulnerability affects FortiManager versions 6.4....

CVE-2024-28995

SolarWinds Serv-U Directory Traversal Vulnerability POC root@kitploit: cat targets.txt | nuclei -duc -t CVE-2024-28995.yaml image Analysis https://t.co/JPCd6Y4v1g Shodan Querys product:"Rhinosoft Serv-U httpd,rhinosoft serv-u httpd"...

zip4j

zip4j This repository contains decompiled source code for the zip4j library versions 1.3.2 vulnerable and 1.3.3 fixed for CVE-2018-1002202, for the CWE-Bench-Java dataset. The original zip4j repository on Github doesn't include code from these versions. Versions Version 1.3.2 Vulnerable Tag : 1.3...

exploit-CVE-2017-6090

Containerized exploitable CVE-2017-6090 This projects builds a container running PhpCollab 2.5.1, containing a remote code execution vulnerability as detailed in CVE-2017-6090. In addition, there is a docker-compse file to start that container and mysql to show the demo, and instructions to explo...

CVE-2019-16278-Nostromo-1.9.6-RCE

CVE-2019-16278-Nostromo-1.9.6-RCE This repository contains an exploit for CVE-2019-16278 in Nostromo Web Server 1.9.6, allowing remote code execution via a directory traversal vulnerability. The script uses pwntools to establish a reverse shell. For educational and authorized testing use only...

log4shell-example

Log4Shell Exploit Test The goal of this project is to demonstrate the log4j cve-2021-44228 exploit vulnerability in a spring-boot setup, and to show how to fix it. This project contains three submodules. One of these has vulnerable code, the other two are patched. How to use this project Run ./mv...

CVE-2020-15392

CVE-2020-15392 User Enumeration on Supravizio BPM 10.1.2 Description A user enumeration vulnerability flaw was found in Supravizio BPM, version 10.1.2. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not,...

apache__rocketmq_CVE-2019-17572_4-6-0

Apache RocketMQ Apache RocketMQ is a distributed messaging and streaming platform with low latency, high performance and reliability, trillion-level capacity and flexible scalability...

crushftp_cve-2025-31161

CrushFTP 10.8.0 — Compilación vulnerable a CVE-2025-31161 Binario precompilado de CrushFTP 10.8.0 para pruebas de penetración autorizadas de CVE-2025-31161. !CAUTION Esta es una compilación de aplicación intencionalmente vulnerable. Solo para pruebas de seguridad e investigación autorizadas. No l...

Wagtail-CMS-XSS

Wagtail-6.4.1-CMS-XSS CVE-2025-45388 Wagtail CMS 6.4.1 Stored XSS CMS Stored XSS Vulnerability PoC Overview This repository demonstrates a Stored XSS vulnerability found in the Wagtail 6.4.1 CMS platform. A malicious JavaScript is embedded in a PDF file, and every time a user clicks on the PDF, a...

CVE-2025-24893

PoC for CVE-2025-24893 — XWiki Remote Code Execution Safe PoC PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11 , 16.4.1 and 16.5.0RC1. ⚠️ IMPORTANT — AUTHORIZED TESTING ONLY This repository contains a proof-of-concept PoC project intended for educational...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...

CVE-2026-16723

CVE-2026-16723 Exploit A standalone C++17 implementation for CVE-2026-16723 , a critical vulnerability affecting Fastjson versions 1.2.68 – 1.2.83. Requirements Linux or WSL on Windows C++17 compatible compiler GCC 7+ or Clang 5+ CMake 3.10 or newer System packages: libzip-dev zlib1g-dev Debian /...

x-stream__xstream_CVE-2021-21345_1-4-15

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...