Flangvik

Flangvik C POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode in…...

CVE-2024-4040

CVE-2024-4040 PoC Python exploit for CVE-2024-4040 Description A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass...

CVE-2021-32161

..| XSStoCommandInjection2 |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Command Injection through the Webmin's File Manager feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's C0de P...

CVE-2024-56058

CVE-2024-56058 VRPConnector = 2.0.1 - Unauthenticated PHP Object Injection Description The VRPConnector plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers t...

CVE-2025-29279

CVE-2025-29279 To exploit this vulnerability, the attacker must insert the payload example.com;echo 'testing' into the "Host Address" in Traceroute6 Diagnostics in the Diagnostics section...

CVE-2019-9053

CVE-2019-9053 CMS Made Simple 2.2.10 - SQL Injection Found by Daniele Scanu. Can be found Here Fixes the problem: "File "/home/user/CVE-2019-9053", line 25 root@kitploit: print "+ Specify an url target" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ SyntaxError: Missing parentheses in call to 'print'. Did you...

CVE-2020-13996

Exploit Title: Joomla J2 Store 3.3.11 - 'filterorderDir' SQL Injection Authenticated Date: 2020-04-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://www.j2store.org/ Software Link: https://www.j2store.org/download.html Reference:...

CVE-2014-7205

Bassmaster NodeJS Plugin RCE PoC bassmaster-rce.py: A Python script to exploit CVE-2014-7205. nodeshell.py: A Python module to generate a reverse shell for NodeJS !!Only use against servers on which you have permission to test Summary CVE-2014-7205 is a Remote Code Execution vulnerability in...

CVE-2023-47218

CVE-2023-47218 CVE-2023-47218: QNAP QTS and QuTS Hero Unauthenticated Command Injection FIXED POC root@kitploit: POST /cgi-bin/quick/quick.cgi?func=switchos&todo=uploaffirmwareimage HTTP/1.1 Host: 192.168.86.42:8080 User-Agent: Mozilla Macintosh Accept: / Content-Length: 164 Content-Type:...

CVE-2021-46363

CVE-2021-46363: Formula Injection in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to perform Formula Injection attacks via crafted CSV/XLS files. These formulas may result in arbitrary code execution on a victim's computer when opening the exported...

CVE-2012-2593

Atmail XSS-CSRF-RCE Exploit Chain PoC atmail-rce.py: Exploits CVE-2012-2593 in Atmail's webmail interface. atmail-csrf.js: Javascript file which leverages CVE 2012-2593 into a CSRF to install a malicious plugin which executes a reverse shell Plugin.php: Atmail plugin to be installed which calls a...

CVE-2024-4577-Exploit

CVE-2024-4577 Exploit Exploit of the PHP CGI Argument Injection vulnerability CVE-2024-4577 to achieve Remote Code Execution RCE on a vulnerable PHP version running in a Windows environment, discovered by Orange Tsai. For more details, check out DEVCORE's Blog. Requirements Language Used = Python...

cve-2023-27372

education purpose only!!!!!...

CVE-2022-42889

Quickstart root@kitploit: sudo apt install golang To run like Python: root@kitploit: go run main.go arg1 arg2 To build executable: root@kitploit: go build main.go Usage: root@kitploit: non@woa:/program$ go run main.go - Usage: ./program vulnerable/web?param= 'ls -la' To Do: Reverse shell...

CVE-2023-30212

CVE-2023-30212 LAB SETUP Prerequisite Download docker.io sudo apt install -y docker.io STEPS 1. Download all files from my repository using the below command. git clone https://github.com/AAsh035/CVE-2023-30212.git 2. Now to make a docker image run the following command: sudo docker build -t vuln...

CVE-2023-45657

CVE-2023-45657 Nexter = 2.0.3 - Authenticated Subscriber+ SQL Injection via 'to' and 'from' Description: The Nexter theme for WordPress is vulnerable to SQL Injection via the 'to' and 'from' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied...

CVE-2026-86197

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are...

CVE-2026-86188

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

Symfony-CVE-Scanner-PoC-

Symfony Vulnerability Scanner Automated scanning tool to detect multiple known vulnerabilities CVE in Symfony applications exposed to the Internet. Developed by m10sec. Features 🔍 Detection of multiple vulnerabilities in Symfony : Validation of Symfony vulnerabilities ✅ Real exploitation validati...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - SQL Injection authentication bypass vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal login form which can allow an attacker to bypass authentication. Affected components...