ClearML-CVE-2024-24590

root@kitploit: / | | | / | | | \ / \ / | | | | | | \ / | | | | | | | | | | | | |/ / | '| |/| | | | /| | | | | | || | / | | | | | | | | | | | || | | |||,|| || ||| || / | - 2024-24590 x OxyDe PoC de Subida de Artefacto Pickle a ClearML Este proyecto demuestra cómo subir dinámicamente un...

CVE-2025-64512

CVE-2025-64512 — pdfminer.six Insecure Deserialization Pickle via Crafted PDF ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal. Table o...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

EUVD-2026-65440

NLTK: Allowlisted pickle loaders still permit code execution in current source...

EUVD-2026-65229

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution...

CVE-2023-37941

Exploitation of Pickle RCE within Superset's Default Cache Information root@kitploit: Author Dinis Cruz Project Superset Description Apache's superset presents different options for caching, all of which based on Flask-Caching. A built-in cache is provided which serializes values for later...

CVE-2025-69219

CVE-2025-69219 — Apache Airflow Providers HTTP RCE via Unsafe Pickle Deserialization Severity: High CVSS 3.1: 8.8 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE: CWE-913 — Improper Control of Dynamically-Managed Code Resources Affected: apache-airflow-providers-http = 5.1.0, Fixed in:...

CVE-2025-64512

CVE-2025-64512 Arbitrary Code Execution in pdfminer.six via Crafted PDF Input PoC based on https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp % python3 mkpickle.py Usage: mkpickle.py output Ex: mkpickle.py 'curl IP:PORT/rce' evil.pickle.gz % python3 mkpdf.py -h usage...

CVE-2021-33026

CVE-2021-33026 Pickle Serialization Remote Code Execution - Memcached Poisoning PoC Exploit What's CVE-2021-3306? "The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains...

Apache-Superset-Remote-Code-Execution-PoC-CVE-2018-8021

Apache Superset pickle library code execution IBM : Apache Superset could allow a remote attacker to execute arbitrary code on the system, caused by the use of unsafe load method from the pickle library to deserialize data. By sending specially-crafted request, an attacker could exploit this...

CVE-2024-37054

CVE-2024-37054 — MLflow pyfunc Deserialization RCE Severity: Critical Affected: MLflow 0.9.0 – 2.14.1 Type: Arbitrary code execution via Python pickle deserialization Description mlflow.pyfunc.loadmodel deserializes pythonmodel.pkl from the artifact store without any sanitization. An attacker who...

Alternative-Approach-Reverse-Shell-Callback-Test-InvokeAI-RCE

Alternative-Approach-Reverse-Shell-Callback-Test-InvokeAI-RCE Alternative Approach: Reverse Shell & Callback Test Overview This repository contains alternative payload approaches for the InvokeAI RCE vulnerability CVE-2024-12029 when SSH key injection fails. The payloads are designed to test if...

Pickle-Deserialization-Exploit-in-Transformers

Exploiting Pickle Deserialization Vulnerability in Transformers Experiment Introduction Introduces the pickle deserialization mechanism and its reduce attack principle, reproduces the deserialization vulnerability CVE-2024-3568 in the Hugging Face Transformers library, analyzes security risks in...

rpc-rce.py

rpc.py RCE Exploit CVE-2022-35411 This is an updated and improved exploit for CVE-2022-35411 , targeting vulnerable versions of rpc.py Original exploit by : Elias Hohl Enhanced by : x7331 for usability, portability, and automation Vulnerability Summary The vulnerability lies in rpc.py's unsafe...

CVE-2026-68771_exploit

CVE-2026-68771 — ComfyUI Unauthenticated Pickle Deserialization RCE Unauthenticated remote code execution in ComfyUI via the LoadTrainingDataset node. LoadTrainingDataset.execute loads dataset shards from the server's output directory with torch.loadf and noweightsonly=True. On PyTorch 2.6 where...

CVE-2025-61765_PoC

Summary A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use...

FlaskCache_CVE-2021-33026_POC

Pickle Serialization Remote Code Execution - Redis Poisoning PoC Exploit Verificar que el servidor redis esté funcionando redis-cli -h 127.0.0.1 -p 6379 ping redis-cli keys redis-cli get Keyid Iniciar escucha con netcat en el puerto 10001 : nc -nvlp 10001 Configuración de entornos para Flask Chac...

CVE-2025-64512

CVE-2025-64512 – pdfminer.six Deserialization PoC Overview This proof-of-concept demonstrates a vulnerability in pdfminer.six CVE-2025-64512 that can lead to arbitrary command execution when a malicious PDF is processed. The exploit uses a crafted PDF that references a malicious, gzip-compressed...

EUVD-2026-64336

NLTK: Default ENFORCE=False Disables All pathsec Security Controls...

CVE-2026-71513

A flaw was found in NLTK. A remote attacker can achieve remote code execution by crafting untrusted transition-parser models. This vulnerability exists in the AllowlistUnpickler, which incorrectly validates only the pickle module string and not the global name. This allows attackers to bypass the...