CVE-2026-76676

Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attack...

CVE-2026-51133

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance = V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component...

CVE-2022-1329

WordPress Plugin - Elementor 3.6.0 3.6.1 3.6.2 Remote Code Execution root@kitploit: Ngày: 16 tháng 4 năm 2023 Khai thác Tác giả: Việt Hùng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://elementor.com/ Link phần mềm: https://wordpress.org/plugins/elementor/advanced/ kéo...

Worpress-CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Auto Shell Upload WordPress Royal Elementor 1.3.78 Shell Upload Visit https://phankz.com...

CVE-2022-1565

WordPress Plugin WP All Import = 3.6.7 - Remote Code Execution RCE Authenticated root@kitploit: Ngày: 05 tháng 11 năm 2023 Tác giả khai thác: Việt HÙng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://www.wpallimport.com/ Link phần mềm:...

CVE-2026-60004-PoC

CVE-2026-60004：Gitea Diffpatch API 远程代码执行 !WARNING 本仓库仅供经授权的安全研究和受控实验室测试使用。请勿对您不拥有或未获得明确评估许可的系统运行该概念验证代码。 概述 CVE-2026-60004 是 Gitea 的 diffpatch API 中的一个严重远程代码执行漏洞。拥有仓库创建或写入权限的已认证用户可以提交一个精心构造的补丁，导致一个可执行的 Git 钩子被实体化到临时裸仓库中。当该钩子被触发时，攻击者控制的命令将以 Gitea 服务账户的权限执行。 如果启用了公开注册，未认证的攻击者可能能够创建一个账户并访问存在漏洞的已认证端...

CVE-2025-2783

Chromium CVE-2025-2783: Sandbox Escape & Full-Chain RCE Exploit This repository contains a full-chain exploit implementation for CVE-2025-2783. The vulnerability resides in Chromium's Ipcz communication layer, allowing an attacker to achieve sandbox escape and arbitrary code execution from a...

RCE-Exploit-Framework

RCE-Exploit-Framework This framework is designed to assist penetration testers or developers in understanding the mechanics of remote code execution RCE exploitation. Features Payload Generator : Supports the creation of custom payloads based on Python, Bash, and PHP. Exploit Executor : Delivers...

Oracle-WebLogic-CVE-2017-10271

Oracle-WebLogic-CVE-2017-10271 WebLogic wls-wsat RCE CVE-2017-10271 Vulnerability Description In the early days, hackers exploited the WLS component vulnerability of WebLogic to launch large-scale remote attacks against enterprise servers. A large number of enterprise servers were compromised, an...

CVE-2026-5027-Langflow

CVE-2026-5027 and CVE-2026-10520 CVE-2026-25089 exploiter: Clone root@kitploit: git clone https://github.com/Layer-6/CVE-2026-5027-Langflow.git cd CVE-2026-5027-Langflow Usage exploit.py file Automatic testing and exploitation. root@kitploit: python3 exploit.py -u https://target.com CLI custom...

CVE-2023-31902

CVE-2023-31902 — Mobile Mouse 3.6.0.4 Remote Code Execution Summary: Mobile Mouse is a Windows application that turns your phone into a mouse/keyboard over the network. It listens on port 9099 TCP and 35913 WebSocket with no authentication by default. The vulnerability allows an unauthenticated...

spectre-attack-demo

Spectre Attack Example Example of using revealed "Spectre" exploit from 2 Jan 2018 CVE-2017-5753 and CVE-2017-5715 Spectre breaks the isolation between different applications. It allows an attacker to trick error-free programs, which follow best practices, into leaking their secrets. In fact, the...

CVE-2026-81925 Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format

Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. An attacker could execute arbitrary JavaScript in the browser of a user who was tricked into submitting a crafted POST request to...

ace-vim-neovim

ace-vim-neovim Vim/Neovim のモデルインによる任意コード実行 CVE-2019-12735 使い方 1. リッスン root@kitploit: nc -vlp 9999 2. ace root@kitploit: vim pocshell.txt その後、localhost でシェルが取得できます。...

Wp_Adning_Advertising_Shell_Upload

WpAdningAdvertisingShellUpload python 2.7...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate │ │ ├─ privatekey = │ │ ├─ cmd = setproperty │...

cve-2025-66478_rce_vulnerable

Modern Blog with shadcn/ui A modern and elegant blog built with Next.js 16, React 19, shadcn/ui and Tailwind CSS. IMPORTANT: Next JS VULNERABLE project created solely for educational, testing and exploitation purposes, NOT RECOMMENDED FOR PRODUCTION DEPLOYMENT, ONLY FOR LOCAL OR CONTROLLED...

CVE-2026-25860

CVE-2026-25860 OpenClinic GA 5.247.01 Reflected XSS via DICOM Image Upload Handler If you want to chain this XSS with RCE you can read: https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce Description OpenClinic GA = v5.351.19 12/05/2026 contains a reflected cross-site...

CVE-2026-65400

CVE-2026-65400 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

Nginx-Rift

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This vulnerability — along with three other memory...