Windows Storage Spaces Controller Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally...

Windows Key Distribution Center Remote Code Execution Vulnerability

Use after free in Windows Key Distribution Center allows an authorized attacker to execute code over a network...

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network...

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network...

Microsoft Office Remote Code Execution Vulnerability

Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network...

Microsoft Office PowerPoint Remote Code Execution Vulnerability

Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network...

Windows Paint Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network...

Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

Windows Volume Manager Extension Driver Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-48282-coldfusion-rds-detection

CVE-2026-48282 — Validación y Detección de RDS en Adobe ColdFusion Validación de laboratorio de CVE-2026-48282 en Adobe ColdFusion Remote Development Services RDS, centrada en evidencia técnica, reconstrucción de eventos y oportunidades de detección defensiva. El repositorio documenta una prueba...

web-penetration-drupal

Web Penetration Testing — Drupal CVE-2018-7600 Type: Internship Project | Company: BB CyberSec | Period: Nov 2024 – Jan 2025 📋 Project Overview This project documents a full penetration test conducted on a Drupal web application as part of my cybersecurity internship at BB CyberSec. The assessmen...

log4j2-vuln-lab

⚠️ Disclaimer : This project is intended for security learning and technical research only. All vulnerability environments are set up locally, and no real targets have been tested. Do not use it for illegal purposes. The risk of using this project is borne by the user. Log4j2 Vulnerability...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE Exploitation & Mitigation CVE-2020-25213 📌 Project Overview This project was developed as part of the IE4012 – Offensive Hacking Tactics & Strategies module. It demonstrates a full cybersecurity attack lifecycle in a controlled lab environment, including: Social engineering attack...

PoC-CVE-2024-23113

Disclaimer The code and materials contained in this repository are provided strictly for educational, research, and authorized security testing purposes. Prohibited Use Do not use this tool/code against any infrastructure, systems, or networks without explicit, prior written permission from the...

CVE-2021-44228

🚨 CVE-2021-44228 — “Log4Shell” A critical remote code execution vulnerability in Apache Log4j 2 , widely known as Log4Shell. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Exploitation & Impact Real-World Impact Detection Mitigation & Fixes Summary 🔎 Overview...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Exploit chain for two vulnerabilities affecting Flowise = 3.0.5. Vulnerabilities CVE-2025-58434 — Unauthenticated Account Takeover The forgot-password endpoint returns a valid password reset token in the API response without requiring authentication. An attacker wi...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MCP stdio env-var injection Unauthenticated remote code execution in Langflow OSS through 1.10.1. The environment-variable blocklist that guards MCP stdio server configuration DANGEROUSENVVARS omits SHELLOPTS, BASHOPTS and PS4. Because th...

CVE-LiteLLM

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual environment...

Spring4Shell

Spring RCE CVE-2022-22965 Vulnerability Environment Environment Information springboot jdk11 tomcat9.0.30 payload Request Header Configuration root@kitploit: "suffix": "%//", "c1": "Runtime", "c2": "%", "DNT": "1", "Content-Type": "application/x-www-form-urlencoded", Request Body Data...

php-jpeg-injector

php-jpeg-injector Inyecta cargas útiles de php en imágenes jpeg. Relacionado con esta publicación. Caso de Uso Tienes una aplicación web que procesa una imagen jpeg a través de la librería gráfica GD de PHP. Descripción Este script inyecta código PHP en una imagen jpeg especificada. La aplicación...