CVE-2024-55557

CVE-2024-55557 Usage root@kitploit: python3 exploit.py --local retrieve from local readable files python3 exploit.py default mode is remote More Read more on CVE-2024-55557 - Weasis 4.5.1 POC https://github.com/user-attachments/assets/a3f64a58-7720-4f93-8bcc-9393d8afcb68...

CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 es vulnerable a un Control de Acceso Incorrecto en admin-head-updates.php Un atacante no autenticado puede explotar una vulnerabilidad de Inclusión de Archivos Locales en el parámetro GET 'lang'. Al enviar una solicitud POST...

gitlab-12.9.0-file-read

L'avertissement Uniquement à des fins de démonstration et de piratage éthique. Le quoi Un script qui se veut meilleur que ce que l'on peut trouver sur exploit-db concernant la lecture arbitraire authentifiée de fichiers sur GitLab v12.9.0 CVE-2020-10977 Le comment 1. Satisfaire la dépendance vous...

cve-2020-5902

cve-2020-5902 cve-2020-5902 POC d'exploit root@kitploit: POC CVE-2020-5902 - r0ttenbeef Usage: cve-2020-5902.py options Options: -h, --help show this help message and exit -u URL, --url=URL specify target url EX:http://100.200.300.10/ -i, --info grap some informations -f FILENAME, --file=FILENAME...

cgiemail-exploit

Cgiemail - Source Code Disclosure/Local File Inclusion Exploit cgiecho a script included with cgiemail will return any file under a websites document root if the file contains square brackets and the text within the brackets is guessable. cgiemail is currently shipped with cPanel, enabled by...

CVE-2026-85706_docker_exp

1.拉docker root@kitploit: git clone https://github.com/FlowerWitch/CVE-2026-85706dockerexp docker compose up -d 2.写入LFI测试信息 root@kitploit: docker exec gitlab-vuln bash -c 'echo "SECRET-CANARY-85706-%%%" /tmp/canary.txt' 3.读取验证 root@kitploit: 绕过方式 1：.json 后缀 curl -s -w "\nHTTP %httpcode\n" -X POST...

CVE-2023-49031

LFI Tikit eMarketing CVE-2023-49031 Découverte En novembre 2023, une nouvelle vulnérabilité d'inclusion locale de fichiers a été identifiée dans la plateforme « eMarketing » développée par Tikit désormais Advanced lors d'une mission client. Ce problème a été résolu avec Advanced en février 2024...

CVE-2016-10956-mail-masta

Mail Masta - Lecture de fichier locale CVE-2016-10956 Le plugin mail-masta 1.0 pour WordPress permet de lire des fichiers locaux dans countofsend.php et csvexport.php. Utilisation root@kitploit: $ ./CVE-2016-10956mailmasta.py -h + Mail Masta - Local File Read CVE-2016-10956 usage:...

CVE-2025-32432-PoC

CVE-2025-32432: Log-Poisoning to RCE Exploit Tool Description This repository contains a professional proof-of-concept PoC exploit written in Go, designed to demonstrate a critical vulnerability chain in Craft CMS. The exploit leverages a log-poisoning vulnerability that leads to Local File...

CVE-2021-46417

CVE-2021-46417 Franklin Fueling Systems Módulo Controlador Colibri - Inclusión de Archivos Locales Argumentos Opcionales: -h, --help muestra este mensaje de ayuda y sale -u url, --url url URL objetivo ej:"http://127.0.0.1" -f file, --file file Objetivos en archivo ej:"ip.txt" Uso python3...

CVE-2026-15667

CVE-2026-15667 CVE-2026-15667 WordPress Event Solution LFI POC Eventin WordPress plugin wp-event-solution ≤ 4.1.22 — authenticated Contributor+ local file inclusion via the eventlayout REST field. For authorized testing only. Do not run this against systems you do not own or have permission to...

CVE-2025-27136-XXE-LocalS3

CVE-2025-27136 XXE-LocalS3 Prueba de concepto para CVE-2025-27136 XXE en Local-S3 └─$ python3 exploit.py http://$ip:8080 /etc/passwd + Servicio S3 detectado + Creando bucket: xxe-32d14993 + Respuesta del servidor: ac3aaf20-e59a-4705-9505-3ebb01db7fc1 + Recuperando archivo mediante ?location +...

CVE-2025-1661

CVE-2025-1661 - Inclusion locale de fichier non authentifiée LFI dans HUSKY – Products Filter Professional pour WooCommerce Description Le plugin HUSKY – Products Filter Professional pour WooCommerce pour WordPress est vulnérable à l'inclusion locale de fichier LFI dans toutes les versions jusqu'...

CVE-2023-24055

Avertissement Ce script est fourni à des fins éducatives et de démonstration uniquement. L'auteur n'approuve ni ne tolère l'utilisation de ce script pour des activités criminelles ou malveillantes ; il ne doit être utilisé que là où une autorisation explicite a été donnée. Utilisez ce script avec...

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin (versions 1.3.20 through 1.3.31 ) contains a Local File Inclusion (LFI) vulnerability in its Lightspeed subsystem. A block attribute is used to build a filesystem path that is included at render time without validation, allowing users with contributor-lev...

EUVD-2026-82687

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion

Essential-Blocks-4.4.3---Unauthenticated-Local-File-Inclusion The plugin does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks. Usage: root@kitploit: usage: PoC.py -h -u URL -p PAYLOAD...

CVE-2024-54374

CVE-2024-54374 Sogrid = 1.5.6 - Unauthenticated Local File Inclusion Description The Sogrid plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server...

CVE-2022-46364-htb-ctf

Herramienta de Explotación SOAP DevArea CVE-2022-46364 Descripción Este exploit especializado está diseñado para el entorno DevArea en Hack The Box. Aprovecha una vulnerabilidad crítica en Apache CXF 3.2.14 CVE-2022-46364 para realizar Inclusión de Archivos Locales LFI y Falsificación de...