Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafte...

Craft CMS - Remote Code Execution via Template Path Manipulation

This template identifies a critical Remote Code Execution RCE vulnerability in Craft CMS, identified as GHSA-2p6p-9rc9-62j9. The vulnerability exists due to improper handling of the --templatesPath query parameter, allowing attackers to execute arbitrary code by referencing malicious Twig...

Apache ActiveMQ Fileserver - Arbitrary File Write

Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request via the Fileserver web application. id: CVE-2016-3088 info: name: Apache ActiveMQ Fileserver - Arbitrary File Write author: fqhsu severity: critical...

rConfig 3.9.4 - Cross-Site Scripting

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in...

Ulterius Server < 1.9.5.0 - Directory Traversal

Ulterius Server before 1.9.5.0 allows HTTP server directory traversal via the process function in RemoteTaskServer/WebServer/HttpServer.cs. id: CVE-2017-16806 info: name: Ulterius Server 1.9.5.0 - Directory Traversal author: geeknik severity: high description: Ulterius Server before 1.9.5.0 allow...

HTTP File Server <2.3c - Remote Command Execution

HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full...

Oracle Weblogic Server - Remote Command Execution

Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. id: CVE-2020-14882 info: name: Oracle Weblogic Server - Remote Command Execution author: dwisiswant0 severity:...

Citrix SD-WAN and NetScaler SD-WAN - SQL Injection

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database...

Nagios XI 5.7.5 - Cross-Site Scripting

Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with th...

CVE-2022-22963

Este repositorio no tiene un README...

Sigma-Rule-for-CVE-2022-30190

This repository does not have a README...

Tell-Me-Root

Tell Me Root Batch Detection Tool Based on cve-2026-24061 Telnet Remote Authentication Bypass Vulnerability This is a super super super lightweight tool written in Python! Hands-free, batch scanning, just sit back and wait for the shell to be fed to you! Even a paramecium can easily dig out...

CVE-2016-2098-PoC

CVE-2016-10033-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Has interactive shell, nice argparse stuff asw Usage root@kitploit: usage: script.py -h --url URL --param PARAM --proxy...

cpanelscanner

CpanelScanner CpanelScanner is a Go CLI tool that reads hosts from stdin, probes HTTPS on a configured port default 2087, and checks whether the response contains a configured marker string for example WHM Login. Its intended use is to identify internet-exposed cPanel/WHM instances so they can be...

audit-axios

audit-axios Scan local repos for vulnerable axios versions and patch interactively. Targets CVE-2026-40175 — CRLF Header Injection leading to Request Smuggling & SSRF. CVSS 9.9, affects all axios 1.15.0. Quick Start root@kitploit: npx audit-axios /Workspace /Projects Usage root@kitploit:...

Path-Traversal-CVE-2024-4956

Este repositorio no tiene un README...

KB5025175-CVE-2022-41099

Este repositorio no tiene un README...

CVE-2026-27940

CVE-2026-27940...

CVE-2023-23946

CVE-2023-23946 Exploit This repository contains a functional Proof of Concept PoC exploit for CVE-2023-23946 , affecting Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. Demonstration Usage root@kitploit: git clone...

WhatsRCE

WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? root@kitploit: sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRC...