CVE-2022-26134

CVE-2022-26134 - OGNL injection vulnerability. Script proof of concept that exploits the remote code execution vulnerability affecting Atlassian Confluence 7.18 and lower products. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or...

ATutor-2.2.4-Language-Exploit

ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Exploit Title: ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Date: 5/24/19 Exploit Author: liquidsky JMcPeters Vendor Homepage: https://atutor.github.io/ Software Link: https://sourceforge.net/projects/atutor/files/latest/download...

CVE-2022-22947

Spring Cloud Gateway Actuator API SpEL Expression Injection Command Execution CVE-2022-22947 Spring Cloud Gateway Actuator API SpEL Code Injection CVE-2022-22947 Usage: root@kitploit: -t http://vuldomain.com // single IP -f urls.txt // read file for batch scan, multi-threaded, fast -c command //...

CVE-2024-31982

CVE-2024-31982 PoC and Bulk Scanner Overview POC for CVE-2024-31982: XWiki Platform Remote Code Execution 14.10.20. This POC is based on this security advisory . How to Use Single Target Scan To scan a single target endpoint: root@kitploit: python CVE-2024-31982.py -u target Bulk Target Scan To...

watchTowr-vs-SonicWall-PreAuth-RCE-Chain

SonicWall SMA 100 PreAuth RCE Chain PoC PoC for SonicWall SMA 100 PreAuth RCE Chain CVE-2023-44221, CVE-2024-38475 See our blog post for technical details https://github.com/user-attachments/assets/b157b39c-d7bd-4385-af7a-e465f8fd4a41 PoC in Action root@kitploit: python...

CVE-2023-4220-exploit

CVE-2023-4220-exploit Unrestricted file upload in the large file upload functionality at /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS versions = 1.11.24 allows unauthenticated attackers to perform stored Cross-Site Scripting attacks and achieve remote code execution by...

Oracle-WebLogic-CVE-2017-10271-master

WebLogic Wls-wsat XMLDecoder Vulnerability Description mitre:https://vulners.com/cve/CVE-2017-3506 Earlier, hackers exploited the WebLogic WLS component vulnerability to launch large-scale remote attacks on enterprise servers. Many enterprise servers were compromised, and the number of attacked...

CVE-2020-15148-bypasses

CVE-2020-15148-bypasses Several bypasses for CVE-2020-15148 Yii2 deserialization poc1 This one is exploitable in version 2.0.37, fixed in 2.0.38, which was assigned CVE-2020-15148. The following three are bypasses. root@kitploit: checkAccess = 'system'; $this-id = 'ls'; namespace Faker use...

r2s

R2S - React2Shell Scanner A web-based vulnerability scanner for CVE-2025-55182 , a critical Remote Code Execution RCE vulnerability in React Server Components. Live Scanner: https://r2s.mxm0z.com About CVE-2025-55182 CVE-2025-55182 is a critical CVSS 10.0 vulnerability in the React Server...

CVE-2022-22947

CVE-2022-22947 A code injection attack on spring cloud gateway Summary of the CVE In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make ...

CVE-2026-Termius

Termius macOS Application Vulnerability Report CVE-2026-Termius Target : Termius macOS Version Tested : Latest as of Jan 2026 Impact : Remote Code Execution RCE, Local Privilege Escalation LPE, App Security Bypass 🚨 Executive Summary Three critical vulnerabilities were identified in the Termius...

Telerik_CVE-2019-18935

TelerikUI Python Scanner telerikrcescan.py Examples Assess an IP for CVE-2019-18935 $ python3 telerikrcescan.py -t 192.168.44.21 Assess a hostname for CVE-2019-18935 $ python3 telerikrcescan.py -t vulnerable.telerik.net Assess a CIDR network range for CVE-2019-18935 $ python3 telerikrcescan.py -r...

CVE-2023-50164-Apache-Struts-RCE

Contains vulnerable WAR file and docker file that can be used to test CVE-2023-50164-Apache-Struts-RCE. This dockerfile and vulnerable application is compiled and designed using resources and code from https://github.com/jakabakos/CVE-2023-50164-Apache-Struts-RCE. Thanks to him for such a detaile...

monstra_cms-3.0.4--getshell

monstracms-3.0.4--getshell monstracms-3.0.4-上传getshell CVE- 2018-17418 代码分析（Code analysis）： 在monstra\plugins\box\filesmanager\ filesmanager.admin.php第150行中存在forbiddentypes变量做黑名单限制，继续跟进该变量 In the line 150 of monstra\plugins\box\filesmanager\ filesmanager.admin.php, there is a forbiddentypes variab...

spring-core-rce

spring-core-rce explotación simple de spring core rce Se puede usar el war https://github.com/fengguangbin/spring-rce-war Se puede usar el entorno docker https://github.com/lunasec-io/Spring4Shell-POC También se puede usar el entorno en línea de vulfocus http://vulfocus.io/ o el laboratorio de...

CVE-2024-4577-Nuclei-Template

CVE-2024-4577 Nuclei Template This repository contains a Nuclei template to detect the PHP CGI Argument Injection vulnerability identified as CVE-2024-4577. Template Details root@kitploit: id: CVE-2024-4577 info: name: CVE-2024-4577 PHP CGI Argument Injection author: Hüseyin TINTAŞ severity:...

CVE-2019-0604

1. Analysis of k8gege's cve-2019-0604-exp.py k8gege's script https://github.com/k8gege/CVE-2019-0604 Honestly, k8gege's Python script is a bit fancy, with a large number of hexadecimal strings split into payload1, 2, 3. Devious. The Python script sends a remote POST payload, which after...

s2-067-CVE-2024-53677

s2-067-CVE-2024-53677 s2-067CVE-2024-53677 Summary File upload logic is flawed, and allows an attacker to enable paths with traversals - similar problem as reported in S2-066 Who should read this All Struts 2 developers and users Impact of vulnerability Remote Code Execution Maximum security rati...

CVE-2024-4358_Mass_Exploit

CVE-2024-4358MassExploit Modified tools from @sinsinology to do mass exploit. Requirements Python 3.x Installation root@kitploit: git clone https://github.com/Sk1dr0wz/CVE-2024-4358MassExploit.git cd CVE-2024-4358MassExploit pip intstall -r requirements.txt How To Run root@kitploit: usage: python...

CVE-2018-3245

Weblogic-CVE-2018-3245 CVE-2018-3245 0x00 Introduction On October 16 local time, and in the early hours of October 17 Beijing time, Oracle officially released the October Q3 Critical Patch Update CPU, which fixed a Weblogic remote code execution vulnerability CVE-2018-2893 that was not fully...