CVE-2024-22939

target:https://github.com/sunkaifei/FlyCms version: v1.0 FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/article/categoryedit Poc root@kitploit: history.pushState'', '', '/' Success:...

fortilogger_arbitrary_fileupload

CVE-2021-3378 | FortiLogger - Unauthenticated Arbitrary File Upload Metasploit Date: 30-01-2021 Exploit Author: Berkan Er [email protected] Vendor Homepage: https://www.fortilogger.com/ Software Link: https://www.fortilogger.com/download Version: 4.4.2.2 Tested on: Windows 10 Enterprise x64...

CVE-2024-24919-Bulk-Scanner

CVE-2024-24919 Bulk Scanner CVE-2024-24919 Check Point Security Gateway Information Disclosure Script based on and the credit goes to: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ This Python script scans lisy of URLs for CVE-2024-24919 vulnerability by sending specifi...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

react2shell

React2Shell - CVE-2025-55182 Exploit PoC A proof-of-concept exploit for CVE-2025-55182, a critical Remote Code Execution vulnerability in Next.js applications using React Server Components. ⚠️ DISCLAIMER THIS TOOL IS FOR EDUCATIONAL AND AUTHORIZED SECURITY TESTING ONLY. ❌ DO NOT use against system...

CVE-2024-4577

Fastest CVE-2024-4577 Exploitation Tool Description: PHP CGI Remote Code Execution The CVE-2024-4577 Exploit Tool exploit.py is a Python script designed to exploit web servers' specific vulnerability CVE-2024-4577. Based on the response content, it sends POST requests to a list of provided hosts ...

CVE-2024-25180

CVE-2024-25180 Overview pdfmake is a pure JavaScript client/server PDF printing library. The affected versions of this package are vulnerable to arbitrary code injection. An attacker can execute arbitrary code by sending a crafted POST request to the /pdf path. The attacker can execute arbitrary...

CVE-2026-89040

Tencent Mass Service Engine in Cluster (MSEC) is affected by a path traversal vulnerability that allows a remote, unauthenticated attacker to send a crafted POST request containing ../, gaining root access on the target device. An attacker who uploads a webshell can then execute arbitrary code as...

EUVD-2026-79672

Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...

CVE-2026-81924

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

cve-2016-1555

Description The module leverages an unauthenticated arbitrary command execution vulnerability in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0. The vulnerability occurs within how the router handles POST requests from 1...

CVE-2024-36401

CVE-2024-36401 用の RCE CVE-2024-36401 GeoServer 用の POC。この POC は、ターゲットからリバースシステムシェルを確立しようとします。 概要 CVE-2024-36401 の POC: GeoServer バージョン 2.25.1、2.24.3、2.23.5 より前の GeoServer 用の RCE。この POC は、phith0n によるセキュリティアドバイザリに基づいています。 動作の仕組み 1. ターゲットからの着信リバースシェル用に、自分のマシンにリスナーをセットアップします。 2. この POC は、ペイロードを含む POST...

CVE-2024-39211

CVE-2024-39211 Kaiten User Enumeration Kaiten - a workflow management system, is vulnerable to unrestricted brute force attacks on user logins and email addresses registered in the system via a simple POST request. References: CVE MITRE Description NVD CVE Usage Simple download bash script and ru...

SSI-CVE-2022-21661

SSI-CVE-2022-21661 信息系统安全第二次作业 研究并利用 CVE-2022-21661 漏洞，该漏洞允许通过插件 POST 请求对 5.8.3 以下版本的 WordPress 进行 SQL 注入。 配置环境 要启动并配置环境，只需运行： root@kitploit: docker-compose run --rm wordpress-cli 系统要求 Docker Docker-Compose Python 3.9+ Argparser Hashcat 运行示例 在 example.md 文件中，您可以跟随一个小教程，其中包含一些示例，帮助您开始利用此漏洞。 漏洞利用本身...

CVE-2025-58434-PoC

CVE-2025-58434 PoC Python proof-of-concept script for triggering POST /api/v1/account/forgot-password. ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Credit zaddy6 Isaac David arthurgervais...

exploit-CVE-2020-24815

exploit-CVE-2020-24815.py this is my first exploit for CVE-2020-24815 put the POST path after url !!!! Example: if the script not work change the cookie on script root@kitploit: $ - pip install -r requirements.txt fix probleme pdftotext not installed: root@kitploit: $ - sudo apt-get install...

CVE-2025-5777

. PoC root@kitploit: POST /p/u/doAuthentication.do HTTP/1.1 Host: 167.xxx.xx.x Content-Length: 5 login . The tool verfiy then 20 more requests to exploit. . Usage:- python CVE‑2025‑5777.py python CVE‑2025‑5777.py -l test.txt...

netwave-dosvulnerability

Netwave IP Camera server vulnerable to unauthenticated Denial of Service via one single huge POST request on any firmware. CVE| Description ---|--- CVE-2018-6479| Unauthenticated remote Denial of Service vulnerability CVSS| Score| Details ---|---|--- 3| 7.3|...

CVE-2022-1040

CVE-2022-1040 愿POC与你同在 外面捡来的 root@kitploit: curl --insecure -H "X-Requested-With: XMLHttpRequest" -X POST 'https://x.x.x.x/userportal/Controller?mode=8700&operation=1&datagrid=179&json="🦞":"test"'...

xsssniper

XSSSNIPER xsssniper is an handy xss discovery tool with mass scanning functionalities. Usage: root@kitploit: Usage: xsssniper.py options Options: -h, --help show this help message and exit -u URL, --url=URL target URL --post try a post request to target url --data=POSTDATA post data to use...