CVE-2017-0199

Exploit toolkit CVE-2017-0199 Exploit toolkit CVE-2017-0199 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other payload to victi...

CVE-2018-9206-jquery-file-upload

CVE-2018-9206 - Blueimp jQuery-File-Upload Lab Vulnerable Docker environment for CVE-2018-9206 - Unrestricted File Upload in Blueimp jQuery-File-Upload ' Execute it curl "http://localhost:8888/jQuery-File-Upload/server/php/files/test.php" Output: CVE-2018-9206-PWNED Or run the PoC script:...

NuReaper

NuReaper — NuGet Package Security Scanner ⚠️ Work in Progress — The project is actively developed. Core scanning engine is functional; database persistence, caching, and full test coverage are planned for upcoming iterations. NuReaper is a .NET 8 backend API that automatically analyzes the securit...

cve_2025_20265

PoC for CVE-2025-20265 Advisory ⚠️ WARNING This is a functional exploit for a 1-day vulnerability. It can execute code on vulnerable systems. Use only on your own internal servers you are authorized to test. Unauthorized use is illegal and unethical. Use at your own risk. You are responsible for...

CVE-2026-78319

A service running on the affected products contains a potential Time-of-Check Time-of-Use TOCTOU race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code...

CVE-2026-22005-OAuth-2.0-Device-Code-Phishing-Short-Interval-

CVE-2026-22005 – OAuth 2.0 डिवाइस कोड फ़िशिंग छोटा अंतराल प्रोग्राम कोड Python root@kitploit: devicecodeserver.py - Authorization server with too-fast polling import time, secrets codes = @app.route'/device/code' def devicecode: code = secrets.tokenurlsafe16 codescode = 'usercode':...

CVE-2025-65791

CVE-2025-65791 — Command Injection in ZoneMinder Overview A critical Command Injection vulnerability exists in ZoneMinder v1.36.34 due to improper input validation in the web/views/image.php component. Unsanitized user-controlled input is passed directly to the PHP exec function, allowing remote...

Blackash-CVE-2025-68613

🚨 CVE-2025-68613 — n8n में क्रिटिकल RCE गंभीरता: 🔴 क्रिटिकल प्रभाव: रिमोट कोड एक्ज़ीक्यूशन प्रभावित प्लेटफ़ॉर्म: n8n वर्कफ़्लो ऑटोमेशन 🧩 अवलोकन CVE-2025-68613 , n8n में एक क्रिटिकल सुरक्षा कमज़ोरी है, जो एक ओपन-सोर्स वर्कफ़्लो ऑटोमेशन प्लेटफ़ॉर्म है। यह समस्या एक प्रमाणित हमलावर को वर्कफ़्लो...

WordPress FS Poster plugin <= 8.0.1 - Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting vulnerability

Authenticated Subscriber+ Remote Code Execution via FFmpeg Path Setting vulnerability discovered by Sullo - Hack LLC in WordPress Plugin FS Poster versions = 8.0.1...

zizmor v1.30.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

CVE-2014-8731-PoC

CVE-2014-8731-PoC - PHPMemcachedAdmin Remote Code Execution I do not host in Github anymore, but on my own Git hosting instance. Go here to see code: https://git.sbani.net/sbani/CVE-2014-8731-PoC...

CVE-2025-69516

CVE-2025-69516 - Tactical RMM Remote Code Execution This repository contains a Python script that automates the exploitation of the CVE-2025-69516 SSTI vulnerability in Tactical RMM. It has been tested on version 1.3.1. Usage root@kitploit: python xpl.py -d api.tactical.xyz -t SESSIONTOKEN -c "id...

CVE-2026-78319 TOCTOU Vulnerability in file exchange

A service running on the affected products contains a potential Time-of-Check Time-of-Use TOCTOU race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code...

EUVD-2026-68988

A service running on the affected products contains a potential Time-of-Check Time-of-Use TOCTOU race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code...

CVE-2026-78319

CVE-2026-78319 affects a file exchange service on affected products (specific product names not stated in the provided documents). The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition , which allows an unauthenticated remote attacker to bypass intended security controls and poten...

CVE-2026-49009

CVE-2026-49009 — मेंडर सर्वर प्रमाणित पथ ट्रैवर्सल से रिमोट कोड निष्पादन द्वारा खोजा गया j0xh-sec HackerOne के माध्यम से · PoC द्वारा INTELEON404 विषय-सूची भेद्यता सारांश प्रभावित संस्करण तकनीकी विश्लेषण प्रूफ ऑफ कॉन्सेप्ट पायथन एक्सप्लॉइट न्यूक्ली टेम्पलेट ShodanX + न्यूक्ली स्कैनर उपयोग पहचान औ...

CVE-2024-11972-POC

Description Name : CVE-2024-11972 CVSSv3 Score : 9.8 Affected Versions : Hunk Companion argparse, requests, urljoin Usage...

CVE-2022-22965

🚨 CVE-2022-22965 — "Spring4Shell" Critical Remote Code Execution RCE vulnerability Publicly disclosed: March 31, 2022 📖 Table of Contents Overview Affected Components Technical Root Cause Exploitation Conditions Impact Severity & CVSS Mitigation & Patching Timeline Comparison with Log4Shell Summa...

nextjs-rce-incident-response

Next.js RCE Incident Response — CVE-2025-55182 Type: Live Production Incident Response Vulnerability: CVE-2025-55182 — React Server Components Insecure Deserialization RCE Affected System: Next.js frontend + remote production server Role: Cyber Security Intern — SenseLive Technologies Date:...

Exploit-CVE-2024-26503

Open eClass RCE Exploit Tool This tool is designed to exploit a known vulnerability CVE-2024-26503 in Open eClass platforms, allowing for remote code execution RCE through an unrestricted file upload flaw. The vulnerability allows attackers to upload a web shell to the server, enabling the...