CVE-2025-1307

Newscrunch Exploit CVE-2025-1307 🚨 Overview This exploit targets a critical vulnerability CVE-2025-1307 in the Newscrunch WordPress theme. The flaw allows authenticated users Subscriber and above to upload arbitrary files due to missing capability checks in the newscrunchinstallandactivateplugin...

CVE-2026-8037-POC

CVE-2026-8037-POC Includes executable command detection and one-click getshell requires server deployment service pco.yaml can be used with nuclei for quick detection Quick Start Interactive Mode root@kitploit: python go.py Enter target URL → select function menu. Detection Target root@kitploit:...

CVE-2019-0232

Exploit for Apache Tomcat CVE-2019-0232 This script exploits the CVE-2019-0232 vulnerability in Apache Tomcat, which allows remote code execution through the improper handling of the ism.bat script. The script leverages a reverse shell technique using certutil and nc.exe Netcat to gain remote...

RCE_CVE-2024-7954-

RCECVE-2024-7954- The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. CRITICAL Exploit: POST...

PCmanBoF

PCman FTP Server Buffer overflow and Remote Code Execution CVE-2013-4730 A very simple buffer overflow using CVE-2013-4730 against PCman's FTP server v.2.0.7 How it works? That easy BoF overwrite the buffer and execute the shellcode that will connect back reverse shell Vuln machines: WindowsXP SP...

CVE-2023-47400

CVE-2023-47400 Proof of Concept for the CVE-2023-47400 Authenticated PHP Remote Code Execution via Arbitrary file write on Nagios XI 5.11.0 !Note This poc is based on the technical advisory published by NCC group...

CVE-2026-63030

CVE-2026-63030 WordPress REST API batch route confusion + SQL injection leading to unauthorized admin creation → Remote Code Execution RCE complete exploit chain PoC. For authorized security testing, vulnerability reproduction, and research only. Do not use against unauthorized targets...

CVE-2025-32432-PoC

CVE-2025-32432 Exploit Scripts Python PoC Pre-auth Remote Code Execution for CraftCMS 3.x / 4.x / 5.x PoC Maintainer: C.T.Y. research use only Vulnerability Discovery: Nicolas Bourras – Orange Cyberdefense Additional PoC Inspiration: SensePost research & Chirag Artani’s public script 1. Overview...

DarkReplica

DarkReplica CVE-2026-23631 Redis Post-Auth RCE Exploit The full technical writeup can be found here: https://www.zeroday.cloud/blog/redis-cve-2026-23631-dark-replica...

webmin_docker_and_exp

Docker-webmin-RCE-lab 1. Dockerfiles for CVE-2019-15107webmin RCE recurrence including v1.890 and v1.920. 2. Exp for each version. Build the image root@kitploit: First, clone the files Then cd webmin1.890/1.920docker docker build -t hachp1/webmin . Running the container root@kitploit: docker run ...

CVE-2024-46986

CVE-2024-46986 Camaleon CMS Exploit - Arbitrary File Upload This repository contains a Python script that automates the exploitation of a file upload vulnerability in Camaleon CMS. The vulnerability allows an attacker to upload arbitrary files such as Ruby scripts to the server, potentially leadi...

pbck-exploit

Mass Exploitation & Validation Framework for Joomla Page Builder CK Unauthenticated Arbitrary File Upload → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigatio...

log4j-CVE-2021-44228

log4j-CVE-2021-44228 On December 5, 2021, Apache identified a vulnerability later identified as CVE-2021-44228 in their widely used Log4j logging service. The vulnerability, also known as Log4shell, enables attackers to gain full control of affected servers by allowing unauthenticated remote code...

CVE-2025-23942-poc

WP Load Gallery Exploit CVE-2025-23942 📌 Description Unrestricted Upload of File with Dangerous Type vulnerability in NgocCode WP Load Gallery allows Upload a Web Shell to a Web Server. This issue affects WP Load Gallery: from n/a through 2.1.6. ⚠️ Vulnerability Details CVE ID: CVE-2025-23942...

CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption https://twitter.com/jduck A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as a...

CVE-2022-22965_Spring4Shell

CVE-2022-22965Spring4Shell CVE-2022-22965 Spring4Shell, SpringShell is a vulnerability in the Spring Framework that uses data binding functionality to bind data stored within an HTTP request to certain objects used by an application. The bug exists in the getCachedIntrospectionResults method, whi...

CVE-2024-4947-PoC

CVE-2024-4947 — V8 Maglev Type Confusion → Full RCE d8 PoC A complete, self-contained exploitation chain for CVE-2024-4947 V8 Maglev type confusion, from the initial type-confusion trigger all the way to arbitrary code execution. The PoC runs against a non-sandboxed d8 build and prints...

CVE-2023-27326

Parallels Desktop VM Escape This repository contains an exploit for a Parallels Desktop vulnerability which has been assigned CVE-2023-27326. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. The exploit was tested on Parallels Deskto...

WSO2-CVE-2022-29464

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Full technical analysis will be published at my blog post: https://mr-r3bot.github.io Usage root@kitploit: python exploit.py -u...

rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-android

CVE-2026-76036 — Dawn WebGPU NPOT Depth/Stencil Mipmap Detection Harness Critical CVSS 9.6, CWE-122 heap buffer overflow in Dawn , Chromium's WebGPU implementation, in Google Chrome on Android prior to 151.0.7922.169 stable 151, released 2026-08-18. Root cause, per Dawn fix commit 178fb7048ad3: t...