CVE-2025-57819_FreePBX

🛡️ CVE-2025-57819 – FreePBX 未认证 SQL注入到远程代码执行 PoC 本仓库包含两个针对 CVE-2025-57819 的 Python 概念验证 PoC 脚本，这是 FreePBX 中的一个关键 未认证 SQL注入漏洞 。 🧠 关于漏洞 CVE-2025-57819 CVE-2025-57819 影响多个版本的 FreePBX，允许 未认证的远程攻击者 通过 admin/ajax.php 中的漏洞参数执行 任意SQL查询 。 该漏洞源于 module=FreePBX\modules\endpoint\ajax 端点中 不充分的输入清理 ，导致后端查询中可直接进...

Geutebrueck_GCore_X64_RCE_BO

GeutebrueckGCoreX64RCEBO 用于 Geutebrueck GCore「视频管理」系统的 Metasploit 模块。已在 1.3.8.42 和 1.4.2.37 版本上完成测试。 在安装了 Geutebrueck 产品（GCore）的 Windows（Win 2012R2、Win8.1 等）系统上，可实现以 NT/System 权限进行的完整远程代码执行。 作者： https://www.infoguard.ch Luca Cappiello Maurice Popp 感谢 xorlab https://www.xorlab.com/...

dockerevil

dockerevil 一个简单的仓库，用于存放我在 Docker 技术中发现的安全漏洞 2016 - 2017 Docker API 权限提升（LPE/RPE） 从离线服务器/最小镜像/TAR Dockerfile 构建提权 Docker SUDO 权限提升（PoC） Nmap 脚本 2019 基于 CodeStudent1995 的漏洞利用 OpenShift 权限提升（oc） Docker 中发现的其他优秀安全漏洞： 滥用 Docker API 如何通过影子容器（Shadow Containers）在虚拟机监控程序中实现远程代码执行、同源绕过与持久化 CVE-2016-9962...

CVE-2025-56819

CVE-2025-56819 Datart v.1.0.0-rc.3 中的一个问题允许远程攻击者通过 INIT 连接参数执行任意代码。 root@kitploit: POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type": "JDBC", "properties": "dbType": "H2", "url":...

Oracle-Identity-Manager-CVE-2025-61757

Oracle Identity Manager CVE-2025-61757 漏洞检测工具 v2.2 🔥 漏洞背景 近日，Oracle Identity Manager 曝出严重远程代码执行漏洞（CVE-2025-61757），该漏洞由于 SecurityFilter 对请求URI处理不当，攻击者可通过添加 ;.wadl 参数绕过身份验证，进而利用Groovy脚本在处理器编译时执行任意代码，最终获取服务器权限。 漏洞危害： CVSS 3.1评分：9.8（高危） 影响范围：全球数千台服务器 利用难度：低 危害程度：极高 🛡️ 工具介绍 为应对这一紧急安全威胁，开发了专用于检测...

CVE-2026-6279.py

説明 このPythonスクリプトは、Avada Builder = 3.15.2 を標的としたCVE-2026-6279のエクスプロイトツールです。 主な動作: Avada固有のショートコード/ページパターンを介して fusionloadnonce をターゲットスキャン Cloudflareがadmin-ajaxをブロックしている場合、AJAXエンドポイントと発信元IPバイパスを発見 fusiongetwidgetmarkup のエクスプロイトリクエストを構築 system, passthru, shellexec, exec, filegetcontents を介したRCEを試行...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI は、'Insert Prompt as Rich Text'（プロンプトをリッチテキストとして挿入）が有効な場合、プロンプトを介して保存型 DOM XSS に対して脆弱であり、ATO/RCE を引き起こします。 概要 カスタムプロンプトをチャットウィンドウに挿入する機能は、'Insert Prompt as Rich Text' が有効な場合、プロンプト本文がサニタイズなしで DOM シンク .innerHtml に割り当てられるため、DOM XSS...

Joomla_CVE_2026_48907

MASTA CVE-2026-48907 スキャナー Joomla! JCE Editor 作成者: Alma !CAUTION 🚨 免責事項 — 使用前にお読みください これは侵入的なセキュリティテストツールです。 root@kitploit: THIS TOOL IS FOR AUTHORIZED SECURITY ASSESSMENTS ONLY. Scanning systems you do NOT own or have WRITTEN PERMISSION to test is ILLEGAL in most jurisdictions. The author Hussei...

CVE-2026-21858

CVE-2026-21858 RCE 针对 n8n 1.120.4 的 PoC 环境，包含一个表单触发器工作流和一个利用脚本。 要求 Docker（Windows 上的 Docker Desktop） Python 3.x（攻击端） 文件 Dockerfile — 构建 n8n 漏洞环境 run.bat — 运行容器（Windows） workflow.txt — n8n 工作流（包含表单触发器） poc.py — PoC 脚本 requirements.txt — PoC 依赖 环境搭建 1. 构建 Docker 镜像 root@kitploit: docker build -t...

Apache Druid - Remote Code Execution

Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. id: CVE-2021-25646 info: name: Apache Druid - Remote Cod...

VMware vRealize Log Insight - Path Traversal

he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. id: CVE-2022-31706 info: name: VMware vRealize Log Insight - Path Traversal...

Sophos Firewall <= 19.0 MR1 - Remote Code Execution

Sophos Firewall version v19.0 MR1 and older is vulnerable to code injection in the User Portal and Webadmin, allowing a remote unauthenticated attacker to execute arbitrary code. id: CVE-2022-3236 info: name: Sophos Firewall = 19.0 MR1 - Remote Code Execution author: daffainfo severity: critical...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

Sitecore Experience Platform - Deserialization of Untrusted Data

Sitecore Experience Platform before 8.2 Update-7 and 9.0 before Update-2 is vulnerable to a remote code execution vulnerability CVE-2019-9874. An attacker can exploit this issue to execute arbitrary code on the affected system via a crafted request to the...

Cobbler <3.3.0 - Remote Code Execution

Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via an XMLRPC method. id: CVE-2021-40323 info: name: Cobbler 3.3.0 - Remote Code Execution author: c-sh0 severity: critical description: Cobbler before 3.3.0 allows log poisoning and resultant remote code execution via ...

SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges. id: CVE-2025-26399 info: name: SolarWinds Web Help Desk 12.8.7 -...

Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. id: CVE-2024-7399 info: name: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution author:...

Flowise - Remote Code Execution

Flowise 3.0.5 contains a remote code execution vulnerability caused by unsafe evaluation of user input in the CustomMCP node's convertToValidJSONString function, letting remote attackers execute arbitrary code with full Node.js privileges, exploit requires user input to be processed by the...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

Apache Tomcat `CGIServlet` enableCmdLineArguments - Remote Code Execution

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by...