CVE-2025-54782

Basic Usage: 1.use root@kitploit: python posttest.py urls.txt 2. Custom Command: 2.command root@kitploit: python posttest.py urls.txt -c "whoami" python posttest.py urls.txt -c "ls -la /tmp" python posttest.py urls.txt -c "cat /etc/passwd" 3. Specify Thread Count: root@kitploit: python...

Block-Spring4Shell

Project Spring4Shell CVE-2022-22965 Blocker Firewall Server Handler - This project is a proof-of-concept POC firewall server designed to detect and block attacks exploiting the CVE-2022-22965 vulnerability, commonly known as Spring4Shell. The server inspects incoming HTTP requests and blocks any...

CVE-2025-49113

CVE-2025-49113 Roundcube ≤ 1.6.10 Post-Auth RCE via PHP Object Deserialization...

CVE-2025-55182

CVE-2025-55182 Proof of concept exploit for CVE-2025-55182. When successful, it will emulate a shell on the remote target over HTTP-POST requests. Works with both HTTP and HTTPS, but skips any certificate checks. Only supports directory changes with absolute paths. How to use 1. Set up the...

CVE-2019-14223

CVE-2019-14223: Open Redirect in Alfresco Share The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulation the “failure” parameter an attacker can redirect a victim to a malicious website over any protocol the attacker desires E.g. http,...

CVE-2023-43040

CVE-2023-43040 This repository contains a proof-of-concept exploit for the CVE-2023-43040 vulnerability found in RADOS Gateway RADOSGW. This vulnerability allows attackers to upload objects to any bucket accessible by the specified access key, potentially leading to unauthorized data manipulation...

CVE-2025-57310

CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High root@kitploit:...

CVE-2013-4322_PoC

CVE-2013-4322PoC A simple python script PoC demonstrating the slow POST chunked transmission vulnerability...

cve-2022-1040

Environment In Python Environment3.10 root@kitploit: It's strongly recommended to use the virtual environment pip3 install baseproxy python3.10 will raise an AttributeError if the version of pyOpenSSLdownloaded with baseproxy is too low. Reinstalling the latest version will fix it. pip3 uninstall...

CVE-2026-9289

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes jsonld/id, jsonld/http/itemid,...

CVE-2026-76579

LiteSpeed Cache for WordPress (all versions up to and including 7.9 ) contains a Reflected Cross-Site Scripting vulnerability in the ESI (esi) parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts by supplying a validly sign...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

Metasploit-Red-Pentest-Lab

Metasploit-Red-Pentest-Lab Lab exercise involving exploitation of the vsftpd 2.3.4 vulnerability CVE-2011-2523 on Metasploitable 2 and post-exploitation steps...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984 Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepausegteditor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with...

CVE-2026-1984

The Ibtana – Ecommerce Product Addons plugin for WordPress contains a missing capability check on the iepa_use_gt_editor AJAX action , affecting all versions up to and including 0.4.7.7 . An authenticated attacker with Subscriber-level access or higher can update or delete arbitrary post meta ent...

CVE-2026-1242

The BlockSpare plugin for WordPress (Gutenberg Site Builder Blocks & Starter Sites) is vulnerable to authorization bypass in all versions up to and including 4.2.6 . The root cause is a logic error in the permission callback where an AND (&&) operator was used instead of an OR (||) operator, allo...

CVE-2026-1242 BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-1242 BlockSpare - Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND && operator instead of an OR || operator. This makes it possible for authenticated attackers, with...

CVE-2026-92403

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that...