CVE-2025-20384

SPLUNK CVE-2025-20384 non so, ho solo letto roba che un amico mi ha mandato e ho iniziato a scrivere del misero codice javascript da principiante POC di Iniezione/Falsificazione/Avvelenamento/Offuscamento di Log Si prega di leggere questo articolo OWASP Log Injection TL;DR Cerca un file statico,...

CVE-2026-22356

CVE-2026-22356: Jetpack CRM Path-Traversal-Schwachstelle und RCE Warnung: Dieses Tool sollte nur in autorisierten Testumgebungen verwendet werden. Der Benutzer ist vollständig verantwortlich für die illegale Nutzung. 📥 Anforderungen root@kitploit: pip3 install requests urllib3 $ python3 exploit.p...

LFI-Destruction

🔥 LFI-Destruction – Framework per Penetration Testing Autorizzato LFI-Destroyer è un framework completo e modulare per lo sfruttamento di Local File Inclusion LFI progettato per professionisti della sicurezza autorizzati. Combina molteplici tecniche di attacco in un unico strumento facile da usar...

CVE-2025-32432

CVE-2025-32432 - PoC per RCE non autenticata in Craft CMS Proof-of-concept funzionante per CVE-2025-32432 , una vulnerabilità di esecuzione remota di codice non autenticata in Craft CMS versioni fino a 5.6.16 incluse interessa anche gli alberi 4.x e 3.x su percorsi di codice equivalenti. Parole...

CVE-2021-3129_exploit

CVE-2021-3129exploit Exploit para CVE-2021-3129 Configuração do laboratório: root@kitploit: $ git clone https://github.com/laravel/laravel.git $ cd laravel $ git checkout e849812 $ composer install $ composer require facade/ignition==2.5.1 $ php artisan serve Uso: root@kitploit: $ git clone...

Adobe_ColdFusion_RCE_Unauthenticated

CVE-2023-26360 — Adobe ColdFusion Esecuzione Remota di Codice non Autenticata Implementazione in Python dell'exploit di esecuzione remota di codice per CVE-2023-26360, basata sull'analisi del modulo originale Metasploit e sul lavoro precedente di jakabakos. Perché esiste questo Il PoC di jakabako...

CVE-2024-2053

Exploit da LFI a RCE tramite Log Poisoning Exploit Python3 per CVE-2024-2053 Artica Proxy 📝 Descrizione Questo script Python3 sfrutta le vulnerabilità di Local File Inclusion LFI per ottenere Remote Code Execution RCE tramite tecniche di log poisoning. Progettato specificamente per Artica Proxy...

CVE-2024-43363

CVE-2024-43363 سكربت استغلال CVE-2024-43363 تم تصميم سكربت بايثون هذا لاختبار ما إذا كان مثيل Cacti عرضة لثغرة CVE-2024-43363، وهي ثغرة تنفيذ تعليمات برمجية عن بُعد RCE ناتجة عن تسميم السجلات. كيف تعمل الثغرة: root@kitploit: تسميم السجلات: يقوم المهاجم بحقن كود PHP في أسماء الأجهزة، ويتم تسجيل ذل...

Cobbler <3.3.0 - Remote Code Execution

Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. id: CVE-2021-40323 info: name: Cobbler 3.3.0 - Remote Code Execution author: c-sh0 severity: critical description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via ...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Remote Code Execution CVSS 9.8 Critical | Unsafe File Operations → Log Poisoning → Phar Deserialization → RCE Übersicht Laravel Ignition 2.5.2 Laravel 8.4.2 ist durch eine RCE-Schwachstelle betroffen, wenn APPDEBUG=true ist. Der Endpunkt /ignition/execute-solution...

CVE-2025-32432-PoC

CVE-2025-32432: Strumento di Exploit da Log-Poisoning a RCE Descrizione Questo repository contiene un exploit proof-of-concept PoC professionale scritto in Go, progettato per dimostrare una catena di vulnerabilità critica in Craft CMS. L'exploit sfrutta una vulnerabilità di log-poisoning che port...

EUVD-2026-62575

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...

GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward

Summary The BalancerForward proxy helper in GoFiber uses Header.Add instead of Header.Set when injecting the X-Real-IP header. This appends the real client IP as a second header value rather than replacing any attacker-supplied value. Upstream servers that read the first X-Real-IP header nginx,...

CVE-2026-9242

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler...

Exploit for Code Injection in Vmware Spring_Framework

PoC — CVE-2022-22965 Spring4Shell Disclaimer: This re...

CVE-2026-43634 HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's...

Exploit for Improper Access Control in Adobe Coldfusion

CVE-2023-26360 — Adobe ColdFusion Unauthenticated RCE Python...

Exploit for Code Injection in Invoiceplane

CVE-2026-25548 — Remote Code Execution in InvoicePlane 1.7.0...

CVE-2026-25548

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution RCE vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion LFI and Log Poisoning attack. An authenticated administrator can execute...

CVE-2026-25548

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A critical Remote Code Execution RCE vulnerability exists in InvoicePlane 1.7.0 through a chained Local File Inclusion LFI and Log Poisoning attack. An authenticated administrator can execute...