CVE-2019-9053

CMS Made Simple Extracts data character by character by checking response delays. Extracts: Salt cmssiteprefs table Admin use...

CVE-2023-25157

CVE-2023-25157 GeoServer OGC Filter SQL Injection Vulnerabilities...

sendmail-clamav-exploit-CVE-2007-4560

Sendmail + ClamAV-Milter Exploit CVE-2007-4560 Python RCE exploit for Sendmail with ClamAV-Milter 0.91.2 CVE-2007-4560. Remote root command injection via SMTP RCPT TO headers. About Python port of the classic Sendmail/ClamAV-Milter remote root exploit originally written in Perl by Eliteboy...

Log4Shell-PoC

root@kitploit: ██╗ ██████╗ ██████╗ ██╗ ██╗███████╗██╗ ██╗███████╗██╗ ██╗ ██║ ██╔═══██╗██╔════╝ ██║ ██║██╔════╝██║ ██║██╔════╝██║ ██║ ██║ ██║ ██║██║ ███╗███████║███████╗███████║█████╗ ██║ ██║ ██║ ██║ ██║██║ ██║╚════██║╚════██║██╔══██║██╔══╝ ██║ ██║ ███████╗╚██████╔╝╚██████╔╝ ██║███████║██║...

CVE-2021-26837

CVE-2021-26837 SQL Injection in HelpSystems / Fortra DeliverNow The SearchTextbox parameter on DeliverNow's log search page /LogGrid.aspx is concatenated directly into a SQL Server query with no parameterisation and no server-side validation. The application also rendered the resulting SQL Server...

CVE-2024-1655

CVE-2024-1655 Description ASUS ExpertWiFi EBM63, EBM68, and RT-AX57 Go firmwares before the 12-04-2024 patch contain a command injection vulnerability in splashpageSDN.cgi function. When an attacker sends a specially crafted request, they can achieve arbitrary code execution. references: Official...

CVE-2025-23061

CVE-2025-23061 - Mongoose Command Injection A proof of concept for the Command Injection vulnerability in Mongoose = 7.0.0 = 8.0.0 8.9.5 CVE-2024-53900 & CVE-2025-23061 Timeline November 7, 2024: Dat Phung identified a critical vulnerability in Mongoose and submitted a security report to Snyk...

XWiki-Platform-RCE-CVE-2025-24893

XWiki Platform Unauthenticated RCE Exploit Overview This script is a refurbished Bash implementation of an exploit targeting the XWiki Platform versions affected by CVE-2025-24893. It leverages a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitra...

MouseServer-1.7.8.5-RCE

WiFi Mouse Server 1.7.8.5 - RCE An optimized Python 3 Proof-of-Concept PoC exploit for WiFi Mouse Server v1.7.8.5. This script leverages an inherent protocol vulnerability to achieve Remote Code Execution RCE via automated keystroke injection. This version has been explicitly modified and tuned f...

CVE-2021-31630-OpenPLC-3-Authenticated-RCE

CVE-2021-31630 OpenPLC 3 WebServer Authenticated Remote Code Execution. Description The presence of Command Injection in Open PLC Webserver v3 enables remote attackers to run arbitrary code by exploiting the "Hardware Layer Code Box" component found on the "/hardware" page of the application. Onl...

CVE-2022-46169

CVE-2022-46169 Exploit for CVE-2022-46169 Cacti versions before 1.2.3 Here remoteclientauthorized checks the clients hostname in poller table for entry root@kitploit: function remoteclientauthorized // ... $clientaddr = getclientaddr; // ... $clientname = gethostbyaddr$clientaddr; // ... $pollers...

CVE-2023-33246_RocketMQ_RCE_EXP

CVE-2023-33246RocketMQRCEEXP CVE-2023-33246 RocketMQ Remote Code Execution Exploit Overview RocketMQ versions 5.1.0 and below are vulnerable to Arbitrary Code Injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this...

CVE-2025-63943

CVE-2025-63943 — SQL Injection in Grocery Store Management System 1.0 Overview A high-severity SQL Injection vulnerability was identified in the searchproducts.php component of Grocery Store Management System 1.0 , a PHP/MySQL-based web application created by anirudhkannan. The issue arises from...

CVE-2024-46532

CVE number: CVE-2024-46532 vendor: 上海顶想信息科技有限公司https://www.kancloud.cn/ product: 互联网医疗系统医疗门诊OpenHIS version: V1.0 affected component: https://github.com/1638824607/OpenHIS?tab=readme-ov-file Reproduction of SQL Injection Vulnerabilities in OpenHIS Vulnerabilities：...

Next.Js-middleware-bypass-vulnerability-CVE-2025-29927

A basic proof of concept of the CVE-2025-29927 vulnerability that allows to bypass the middleware scripts. Details: Read Here This uses Next.js version 15.2.2. The vulnerability allows the user to bypass the middleware script which contains the verification and can access the admin page without...

Event-ID-217-Rule-Name-SOC254-Apache-OFBiz-Auth-Bypass-and-Code-Injection-0Day-CVE-2023-51467-

This repository does not have a README...

CVE-2018-11776-FIS

CVE-2018-11776 is a security vulnerability in Apache Struts, a popular framework for developing web applications. This vulnerability allows attackers to carry out remote attacks by injecting malicious code into data fields of HTTP requests. This vulnerability has been widely exploited in...

CVE-2024-24140

CVE-2024-24140: Daily Habit Tracker App SQL Injection Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/CVE-2024-24140.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24140/blob/main/CVE-2024-24140.md...

Exploit_CVE-2019-17558-RCE

ExploitCVE-2019-17558-RCE Apache Solr 1.4 Injection to get a shell to Encode url, postrequest, getrequest...

HTTP-Request-for-PHP-object-injection-attack-on-CVE-2023-41892

This type of attack attempts to exploit the PHP application's deserialization process to execute arbitrary code or carry out unintended actions on the server. Mitigation Strategies To defend against PHP object injection and similar attacks, consider the following strategies: Disable PHP Object...