CVE-2017-10271

Brief Description Command execution with echo output Direct shell upload Tested OK on Linux with WebLogic 10.3.6.0 Usage python weblogicwlswsatexp.py -t 172.16.80.131:7001 root@kitploit: usage: weblogicwlswsatexp.py -h -t TARGET -c CMD -o OUTPUT -s SHELL optional arguments: -h, --help show this...

CVE-2024-21413-Vulnerabilidad-Outlook-LAB

CVE-2024-21413 – Outlook 实验室漏洞 漏洞描述 CVE-2024-21413 是 Microsoft Outlook 中发现的一个严重漏洞，允许远程攻击者通过精心构造的电子邮件执行恶意链接。该漏洞利用 file:// 协议将受害者重定向到攻击者控制的 SMB 共享，可能导致 NTLM 凭据泄露或本地文件的未授权访问。 Windows 10 服务启动脚本 + 凭据 Windows 10 实验室中用户 victim 的密码是 victim，服务器 hMailServer 的密码是 victim 邮箱 [email protected] 的密码是...

CVE-2026-7275-moodle

CVE-2026-7275-moodle PoC & documentation for CVE-2026-7275 : Moodle Google Drive Repository repositorygoogledocs — Path Traversal / Arbitrary File Write that can lead to RCE on unpatched Moodle versions. Disclaimer: For authorized security research, auditing, and defensive education only. Do not...

CVE-2025-10585-The-Chrome-V8-Zero-Day

CVE-2025-10585: El Zero-Day de Chrome V8 que Necesitas Parchear Hoy ⚔️🛡️ Google ha lanzado un parche fuera de banda esta semana para CVE-2025-10585 , una grave vulnerabilidad de type-confusion en el motor V8 JavaScript/WebAssembly de Chrome. El error no es teórico: el Grupo de Análisis de Amenazas...

CVE-2024-23346-exploit

CVE-2024-23346-exploit This is a exploit for the known Remote Code Execution RCE vulnerability in the pymatgen CVE-2024-23346 Python library by uploading a malicious CIF file to the hosted CIF Analyzer website on the Chemistry machine from Hack the Box. NVD CVE LINK :...

CVE-2021-22205

CVE-2021-22205 基于 mr-r3bot/Gitlab-CVE-2021-22205 的Fork 简介 CVE-2021-22205: Gitlab 未授权远程代码执行漏洞 EXP 移除了对djvumake & djvulibre的依赖，直接内部生成payload，可在win平台执行。 使用方法 root@kitploit: 需要授权 python3 exploit.py -u -p -t -c 未授权 python3 exploit.py -t -c...

PoC-for-CVE-2021-38540-

CVE-2021-38540 Proof of Concept Missing Authentication on Critical component Known as CVE-2021-38540 About this bug: The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, variables List Variables PoC Source: root@kitploit: POST /variable/varimport HTTP/2 Host...

wordpress-cve-2026-63030

WordPress REST API Batch Route Confusion + SQL Injection → RCE Pre-authentication, unauthenticated, no plugins required. Works against a stock WordPress install via the REST API batch endpoint...

CVE-2018-10562

CVE-2018-10562 CVE-2018-10562 exploit About RCE on GPON home routers CVE-2018-10561:Authentication Bypass CVE-2018-10562: Command Injection Dependencies required requests urllib2 ssl re Screenshots...

F5-BIG-IP-RCE-CVE-2022-1388

CVE-2022-1388 F5 BIG-IP RCE Multi-threaded Detection Usage: root@kitploit: 单个url: python3 CVE-2022-1388.py -u https://xxx.xxx.xxx.xxx 批量多线程: python3 CVE-2022-1388.py -f url.txt 执行命令: python3 CVE-2022-1388.py -u https://xxx.xxx.xxx.xxx -c whoami Result:...

CVE-2021-41773

CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...

cve-2025-63888-exploit

CVE-2025-63888 ThinkPHP 5.0.24 File Inclusion RCE Exploit A security research tool for detecting and testing the CVE-2025-63888 vulnerability in ThinkPHP 5.0.24, which allows Remote Code Execution through file inclusion attacks. ⚠️ Disclaimer This tool is for authorized security testing and...

-CVE-2017-0785-BlueBorne-PoC

-CVE-2017-0785-BlueBorne-PoC CVE-2017-0785 BlueBorne PoC General Overview Armis Labs revealed a new attack vector endangering major mobile, desktop, and IoT operating systems, including Android, iOS, Windows, and Linux, and the devices using them. The new vector is dubbed “BlueBorne”, as it sprea...

cve-2023-36845-scanner

Vulnerability Scanner for Juniper CVE-2023-36845 This vulnerability scanner can be used to scan Juniper firewalls to determine if they are vulnerable to CVE-2023-36845. Because this is built on top of go-exploit, this scanner has two phases: Target verification to ensure the target is a potential...

CVE-2024-25153

CVE-2024-25153 这是 CVE-2024-25153 的概念验证程序，该漏洞是 Fortra FileCatalyst Workflow 5.x（5.1.6 Build 114 之前的版本）中的一个远程代码执行漏洞。 完整技术细节请参见 https://labs.nettitude.com/blog/cve-2024-25153-remote-code-execution-in-fortra-filecatalyst 使用方法 使用以下命令运行利用程序： root@kitploit: CVE-2024-25153.py --host --port --url --cmd 仅...

WebLogic-RCE-exploit

This repository does not have a README...

cve-2025-32433

Build root@kitploit: » git clone https://github.com/0xPThree/cve-2025-32433.git && cd cve-2025-32433 » docker build -t erlang-ssh . » docker run -d --name erlang-ssh -p 2222:2222 erlang-ssh POC root@kitploit: kdev :: /erlang/CVE-2025-32433 ‹main› » python3 cve-2025-32433.py -h usage:...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 es una vulnerabilidad crítica en WSO2 Identity Server, una plataforma de gestión de identidad y acceso de código abierto. La vulnerabilidad permite a atacantes remotos cargar archivos JSP maliciosos que pueden ejecutar comandos arbitrarios en el sistema objetivo con...

CVE-2022-22965

CVE-2022-22965 Spring4Shell CVE-2022-22965 Usage 1. show info root@kitploit: ❯ go run main.go -s INF VulnInfo: "Name": "CVE-2022-22965", "VulID": "nil", "Version": "1.0", "Author": "", "VulDate": "2022-03-30", "References": "https://nosec.org/home/detail/4983.html" , "AppName": "Spring Core",...

CVE-2023-32315

CVE-2023-32315 Openfire 的管理控制台（Admin Console）是一个基于 Web 的应用程序，被发现在 setup 环境中存在路径遍历漏洞。 这使得未认证用户可以利用已配置好的 Openfire 环境中的未认证 Openfire Setup Environment，访问本应仅供管理员使用的 Openfire Admin Console 中的受限页面，并可能导致远程代码执行 RCE。 截图 要求 Python3.7+ 支持的操作系统 Linux 用户 Windows 用户 开始使用 root@kitploit: $ git clone...