CVE-2024-25277

CVE-2024-25277 discovered on MW45APT02.0002 Resources and PoCs This repo serves as collection of scripts and PoCs gathered during analysis and discovery of CVE-2024-25277. You can read more about the finding on:...

bouncy-castle-generative-test-poc

बाउंसी कैसल भेद्यता का जनरेटिव परीक्षण CVE-2020-28052 परीक्षण चलाना भेद्य संस्करणों का परीक्षण करें डिफ़ॉल्ट 1.66 root@kitploit: $ clojure -M:test $ clojure -M:test:v1.65 भेद्यता से पहले और पैच के बाद के संस्करणों का परीक्षण करें 1.67 root@kitploit: $ clojure -M:test:v1.64 $ clojure -M:test:patch...

CVE-2021-21551

PoC for CVE-2021-21551 Windows LPE using the Dell dbutil23.sys driver. Exploit approach Implement read/write, allocate shellcode, flip page to bypass smep, overwrite haldispatch ptr, execute shellcode...

CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage root@kitploit: $ python...

Weblogic_Unauthorized-bypass-RCE

CVE-2020–14882 Weblogic Unauthorized bypass RCE CVE-2020-14882 Oracle Weblogic Unauthorized bypass RCE test script it works on Python3 Requests root@kitploit: POST /console/images/%252E%252E%252Fconsole.portal HTTP/1.1 Host: User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36...

CVE-2026-59243_exploit

CVE-2026-59243 — Apache Airflow FAB Provider OAuth Auth Bypass → DAG RCE Authentication bypass in Apache Airflow's FAB auth-manager provider apache-airflow-providers-fab, leading to remote code execution via a triggered DAG. The provider decodes the Azure OAuthidtoken with signature verification...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability I: Vulnerability Description ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...

CVE-2023-4357-Exploitation

CVE-2023-4357-Exploitation Network Security Project Description Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. Reproduce Set up the Environment Download Chrome on Linux...

CVE-2015-7214

CVE-2015-7214 Qu'est-ce que CVE-2015-7214 ? Veuillez consulter le lien suivant. Attaque de lecture cross-site via des URI data et view-source Contenu www/index.html PoC de contournement de la SOP pour le Web local/index.html PoC de contournement de la SOP pour le local Prérequis Firefox version...

CVE-2024-6043

CVE-2024-6043 root@kitploit: CVE-2024-6043 CVE-2024-6043 Overview This Python tool exploits the CVE-2024-6043 vulnerability, which affects the SourceCodester Best House Rental Management System 1.0. The vulnerability allows remote attackers to perform SQL Injection via the adminclass.php file,...

Security Bulletin: IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service [CVE-2026-16892]

Summary IBM i is vulnerable to allowing a remote authenticated attacker to bypass security restrictions CVE-2026-16892 in Network Authentication Service NAS as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16892 DESCRIPTION: IBM i could allow a remote...

poc-cve-2019-14287

CVE-2019-14287 का PoC अवलोकन यह sudo की भेद्यता CVE-2019-14287 को Docker कंटेनर पर पुनरुत्पादित करने वाला एक नमूना है। अभ्यास के चरण 1. docker compose up -d से कंटेनर शुरू करें 2. docker exec -it vulnerablesudoapp bash से कंटेनर में प्रवेश करें 3. whoami और id कमांड चलाकर पुष्टि करें कि आप एक...

Hikvision-CVE-2017-7921-decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor यह python फ़ाइल उन hikvision कैमरों द्वारा उपयोग किए जाने वाले configurationFile को डिक्रिप्ट करेगी जो CVE-2017-7921 के लिए संवेदनशील हैं। https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ विवरण Hikvision IP कैमरे...

nextjs-middleware-exploit

Next.js Middleware Vulnerability Research CVE-2025-29927 This repository demonstrates a critical vulnerability in Next.js middleware CVE-2025-29927, which affects versions 11.1.4 through 15.1.7. This vulnerability allows for authorization bypass , CSP bypass , and potential DoS attacks through...

nextjs-middleware-exploit

Next.js मिडलवेयर भेद्यता अनुसंधान CVE-2025-29927 यह रिपॉजिटरी Next.js मिडलवेयर में एक महत्वपूर्ण भेद्यता CVE-2025-29927 का प्रदर्शन करती है, जो संस्करण 11.1.4 से 15.1.7 तक प्रभावित करती है। यह भेद्यता प्राधिकरण बाईपास , CSP बाईपास , और कैश-पॉइज़निंग के माध्यम से संभावित DoS हमलों की अनुमति देती ह...

PT-2026-84356

Name of the Vulnerable Software and Affected Versions OpenAI Codex CLI affected versions not specified OpenAI Codex Desktop affected versions not specified Description OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the core.fsmonitor setting. If...

PT-2026-84528

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.2 Thunderbird versions prior to 155 Description The mail.allowed attachment hostnames advanced configuration setting is used in a regular expression without proper escaping. This flaw allows certain unintended...

PT-2026-84250

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description A protection mechanism failure allows an authenticated user with limited privileges to bypass access restrictions and gain escalated privileges. Recommendations At the moment, there i...

RockyLinux 10 : freerdp (RLSA-2026:61378)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61378 advisory. FreeRDP: FreeRDP: Resource exhaustion due to oversized chunked HTTP responses CVE-2026-67297 FreeRDP: FreeRDP: Memory disclosure or denial of service v...

PT-2026-84229

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...