659592 matches found
CVE-2014-6271
Shellshock Vulnerability Checker This script checks if a website is vulnerable to the Shellshock vulnerability CVE-2014-6271. Summary: The Shellshock vulnerability, also known as Bashdoor, is a security flaw that was discovered in September 2014 in the Unix Bash shell. The vulnerability allows...
Magento-eCommerce-RCE-CVE-2015-1397
Magento Shoplift Exploit SUPEE-5344 - CVE-2015-1397 Overview This script exploits the CVE-2015-1397 vulnerability in Magento, commonly referred to as the Magento Shoplift exploit. It allows an attacker to create a new admin user in the Magento database by injecting SQL payloads. Originally writte...
CVE-2025-8088-Exploit
CVE-2025-8088 WinRAR Exploit 🔓 A proof-of-concept exploit for WinRAR vulnerability CVE-2025-8088 affecting versions 7.12 and lower. This tool creates a malicious RAR archive that embeds payloads in Alternate Data Streams ADS with path traversal, potentially leading to arbitrary code execution. Th...
CVE-2022-29078
CVE-2022-29078 | EJS SSTI → RCE White Hat School 4th Class 32 - Sangbeom Woo @taka3636 Summary EJS tags, such as Hello . Internally, EJS compiles the template string into a JavaScript function and then executes it to generate the final HTML. In other words, it is a code generator that "converts...
CVE-2023-4220
Proof of concept exploit for CVE-2023-4220 Affected product : Chamilo = 1.11.24 This CVE abuses an unauthenticated file upload vulnerability in Chamilo 1.11.24 and lower. An attacker has the ability to upload PHP files with no restrictions, leading to RCE. How to use root@kitploit: python3...
CVE-2024-6529
Proof of Concept PoC for Vulnerabilities in WordPress Plugins This repository contains Proof of Concept PoC scripts for various vulnerabilities discovered in different WordPress plugins. These scripts demonstrate how attackers can exploit these vulnerabilities to perform malicious actions. Table ...
CVE-2024-50849
CVE-2024-50849: Stored XSS in the WorldServer v11.8.2 A Stored Cross-Site Scripting XSS vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code. An authenticated high-privileged user must go to the "Rules" page...
CVE-2025-67888
CVE-2025-67888 Control Web Panel = 0.9.8.1208 admin/index.php OS Command Injection Vulnerability Affected Versions: Version 0.9.8.1208 and prior versions. Vulnerability Description: User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly...
CVE-2025-26633
CVE-2025-26633 - MSC EvilTwin PoC Proof of Concept PoC for CVE-2025-26633 vulnerability exploiting Microsoft Management Console MMC About This PoC simulates the CVE-2025-26633 vulnerability, discovered by Trend Micro, which exploits the loading of malicious .msc files for remote command execution...
CVE-2025-58180
CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload In OctoPrint version =1.11.2, an attacker with file upload access e.g., valid API key or session can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote...
cve-2025-55182-poc
CVE-2025-55182 React2Shell - Academic Proof of Concept ⚠️ DISCLAIMER: EDUCATIONAL USE ONLY This repository contains functional exploit code for a critical vulnerability CVSS 10.0. It is intended strictly for academic research, security analysis, and educational purposes. Do not use this code...
CVE-2019-19609-POC-Python
The script will try to reset the password to the one declared in the "updatedpass" variable, if it succeeds - it will give a JWT token from Strapi and use it to execute commands. Executing bind commands won't work unless sending a reverse shell payload, with bash or python or whatever. You can...
Point-to-Point-Protocol-Daemon-RCE-Vulnerability-CVE-2020-8597-
Vulnerabilidad RCE del demonio del Protocolo Punto a Punto CVE-2020-8597- Instituto de Tecnología de la Información de Sri Lanka root@kitploit: Asignación 1 M. P. D. M. Dias IT19165530 MLBWDY2S113.1 Vulnerabilidad RCE del demonio del Protocolo Punto a Punto CVE-2020-8597 Programación de Sistemas ...
CVE-2019-2725
CVE-2019-2725 WebLogic Universal Exploit - CVE-2017-3506 / CVE-2017-10271 / CVE-2019-2725 / CVE-2019-2729 payload builder & exploit Info / Help root@kitploit: $ python3 weblogicexploit.py -h ======================================================================== | WebLogic Universal Exploit | |...
CVE-2023-51385_test
Verificación de CVE-2023-51385 Primero es necesario añadir el siguiente contenido en /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Existe inyección de comandos en la sentencia del archivo .gitmodules root@kitploit: url = ssh://echo...
Hacking-pdf.js-vulnerability
🚨 CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js This project demonstrates and analyzes CVE-2024-4367 , a high-severity vulnerability in Mozilla’s PDF.js library that allows arbitrary JavaScript execution through improper type checking in font handling code. Our research shows how a...
CVE-2021-30860
CVE-2021-30860 CVE-2021-30860 FORCEDENTRY es una vulnerabilidad conocida en MacOS, iOS y WatchOS. Permite la ejecución arbitraria de código al enviar a un dispositivo víctima un "PDF manipulado maliciosamente". Esta vulnerabilidad fue corregida por Apple el 13 de septiembre de 2021 con las...
westone-CVE-2021-21972-scanner
westone-CVE-2021-21972-scanner Vulnerabilidad de ejecución remota de código en VMware vCenter Server. Un atacante malicioso con acceso al puerto 443 puede enviar una solicitud cuidadosamente construida al vCenter Server, lo que eventualmente provocará la ejecución remota de código arbitrario...
cve-2019-9193
CVE-2019-9193 • CVE-2019-9193 vulnerabilidad PostgreSQL tiene una vulnerabilidad que permite ejecutar código arbitrario dentro del sistema operativo de la base de datos a través de la funcionalidad "COPY TO / FROM PROGRAM" El vector de ataque es el Usuario que pertenece al grupo "SuperUser" y...