632781 matches found
0-click-RCE-Exploit-for-CVE-2024-50498
CVE-2024-50498 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858512517774868845 This repository contains a proof-of-concept exploit for CVE-2024-50498, an unauthenticated code injection vulnerability in the LUBUS WP Query Console WordPress plugin, leading to...
CVE-2020-17530
CVE-2020-17530 Quick POC for CVE-2020-17530. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language OGNL evaluation on raw user input in tag attributes may lead to remote code execution RCE. root@kitploit: $ python CVE-2020-17530.py --help usage: CVE-2020-17530.py -h...
cve-2025-24813-poc
CVE-2025-24813 Apache Tomcat RCE Exploit PoC This repository contains a proof-of-concept exploit for CVE-2025-24813, a Java deserialization vulnerability in Apache Tomcat. Based on absholi7ly/POC-CVE-2025-24813/. Prerequisites Docker Setup 1. Install dependencies: root@kitploit: uv venv source...
CVE-2019-6340-Drupal-8.6.9-REST-Auth-Bypass
CVE-2019-6340 / SA-CORE-2019-003 Three scripts included to demonstrate how Drupal 8.6.9 is vulnerable to CVE-2019-6340: createnodeviarest.py - Example of normal authenticated node create with REST API doesnotcorrespond.py - Proving the request is processed even without authentication exploit.py -...
RAMnesia-Attack
This research presents a comprehensive analysis of two critical classes of attacks on the hardware memory of modern computer systems using DDR5 memory: Phoenix Rowhammer Attack CVE-2025-6202 and RAMnesia Attack CVE-2023-39910 . Both attacks demonstrate fundamental vulnerabilities in the processin...
CVE-2019-16759
CVE-2019-16759 vBulletin 5.0 5.5.4 - 'widgetphp ' Unauthenticated Remote Code Execution Interactive-Like Command-Line Console for CVE-2019-16759 Usage: root@kitploit: python3 exploit.py Enter the Site with Http/Https and Get the Shell :p...
CVE-2018-17431-PoC
CVE-2018-17431-PoC Proof of consept for CVE-2018-17431 Exploit Title: Comodo Firewall & Central Manager UTM All Release before 2.7.0 & 1.5.0 Remote Command Execution Web Shell based Exploit Author: Milad Fadavvi Vendor Homepage: https://www.comodo.com/ Software Link:...
ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend
ToolShell-CVE-2025-53770-SharePoint-Exploit-Lab-LetsDefend TL;DR Yo, in this LetsDefend lab I dove into a SharePoint zero-day called ToolShell CVE-2025-53770. Basically, I mimicked a real-world attack where a malicious POST request bypassed auth, ran PowerShell to steal MachineKeySection keys,...
l4j-info
l4j-info Compiling valuable links as I find them documenting CVE-2021-44228 or Log4J Critical First Party advisories: Existing Log4J 1.2 vulnerability CVE-2019-17571 is also potentially present Apache Log4J Version 2.x Security Information VMWare critical vulnerability advisory Cisco product...
CVE-2016-10033
PoC for CVE-2016-10033 RCE against WordPress 4.6 usage: root@kitploit: ./CVE-2016-10033.py example: root@kitploit: ./CVE-2016-10033.py http://site.com/ 1.2.3.4:4444 admin Python port +alterations of https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html Required:...
CVE-2019-5736-PoC
CVE-2019-5736-PoC PoC for CVE-2019-5736 Created with help from @singe, @cablethief, and @feexd Tested on Ubuntu 18.04, Debian 9, and Arch Linux. Docker versions 18.09.1-ce and 18.03.1-ce. This PoC does not currently work with Ubuntu 16.04 and CentOS. Go checkout the exploit code from Dragon Secto...
CVE-2026-26830
CVE-2026-26830: OS command injection in pdf-image Summary pdf-image through version 2.0.0 allows OS command injection via the pdfFilePath argument. The package builds shell command strings with util.format and executes them with childprocess.exec. If an application passes an attacker-controlled...
CVE-2017-0199-Fix
CVE-2017-0199 Fix Remove CVE-2017-0199's ability to execute code by changing the default handler for .hta files. The default handler for files invoked through OLE2 COM Objects is stored separately from the local system's default application and can only be changed through the registry. Basic Logi...
CVE-2025-54424
CVE-2025-54424 CVE-2025-54424：1Panel 客户端证书绕过RCE漏洞 一体化工具 扫描+利用 漏洞简介 1Panel 是一个开源、现代化的 Linux 运维管理面板，提供图形化界面用于部署网站、管理服务器和运行服务。 受影响版本中，Agent 端 TLS 认证策略为 tls.RequireAnyClientCert，仅要求提供证书但不验证其可信性。攻击者可通过自签名证书绕过 TLS 校验，并伪造CN字段为panelclient，绕过应用层校验。最终攻击者可伪造证书进行未授权命令执行接口调用，导致远程命令执行漏洞。 影响版本...
CVE-2024-3094
Security Review & Threat Model: CVE-2024-3094 xz-utils / OpenSSH This repository contains the results of analyzing the critical vulnerability CVE-2024-3094 backdoor in the liblzma library of the xz-utils package, leading to RCE via the OpenSSH process. As part of the project, an isolated test...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...
org.apache.activemq/activemq-broker: org.apache.activemq/activemq-all: org.apache.activemq/apache-activemq: Apache ActiveMQ: Arbitrary code execution via improper input validation in Jolokia JMX-HTTP bridge
A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...
jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...