CVE-2018-7600

CVE-2018-7600 root@kitploit: PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 Drupalgeddon 2. Installation: $ git clone https://github.com/dwisiswant0/CVE-2018-7600 $ cd CVE-2018-7600/ $ composer install Usage: $ php exploit.php WARNING! For Educational Purposes Only! References: -...

CVE-2021-40444

CVE-2021-40444 PoC 恶意 docx 生成器，用于利用 CVE-2021-40444（Microsoft Office Word 远程代码执行） 此脚本的创建基于对样本（938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52，docx 文件）的一些逆向工程。 你需要先安装 lcab（sudo apt-get install lcab） 查看 REPRODUCE.md 了解手动复现步骤 如果你的生成的 cab 文件不起作用，请尝试将 exploit.html 的 URL 指向 calc.cab 使用...

CVE-2019-11043

CVE-2019-11043 php-fpm+Nginx RCE 0x01 install phuip-fpizdam-Mac go get github.com/neex/phuip-fpizdam go install github.com/neex/phuip-fpizdam root@kitploit: ale@Pentest /go go get github.com/neex/phuip-fpizdam ale@Pentest /go go install github.com/neex/phuip-fpizdam ale@Pentest /go ls bin src...

CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v4.0 Exploit toolkit CVE-2017-0199 - v4.0 es un práctico script en Python que proporciona a pentesters e investigadores de seguridad una forma rápida y efectiva de probar Microsoft Office RCE. Puede generar un archivo malicioso RTF/PPSX y entregar metasploit /...

CVE-2025-22604-Cacti-RCE

CVE-2025-22604-Cacti-RCE...

CVE_2020_2546

Twitter: @Hktalent3135773 1、Weblogic RCE exploit CVE20202546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3 2、exploit GIOP + send bind CVE-2020-2555、CVE-2019-2888、CVE-2019-2888 u otros GIOP + send jta rmi u otros GIO...

CVE-2019-10915

La vulnerabilidad es un bypass de autenticación en el servidor TIA Administrator. Un atacante podría ejecutar comandos arbitrarios de la aplicación a través de websockets en el servidor node.js que está expuesto externamente por defecto. Al explotar esta vulnerabilidad, un atacante remoto no...

CVE-2026-81891

elFinder (open-source web file manager) is vulnerable to remote code execution prior to version 2.1.70 . The flaw resides in checkExtractItems() in php/elFinderVolumeDriver.class.php, which calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, ...

vBulletin-CVE-2025-48828-Multi-target

💥 vBulletin Remote Code Execution Scanner replaceAdTemplate This Python tool automates the detection of unauthenticated RCE vulnerabilities in vBulletin via the replaceAdTemplate exploit vector. Based on the original proof-of-concept by EgiX , this version supports batch scanning , multithreading...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Description This is my PoC for the CVE-2023-30253 Dolibarr 17.0.0 PHP Code Injection, when the CMS Website plugin core is enabled, an authenticated attacker can obtain remote command execution via php code injection bypassing the application restrictions...

CVE-2025-26264

CVE-2025-26264 CVE-2025-26264 - GeoVision GV-ASWeb con la versión 6.1.2.0 o inferior, contiene una vulnerabilidad de Ejecución Remota de Código RCE dentro de su función de Configuración de Notificaciones. Un atacante autenticado con privilegios de "Configuración del Sistema" en ASWeb puede explot...

CVE-2017-12615-PoC

CVE 2017-12615 Apache Tomcat Windows RCE ⚠️Advertencia Este es un entorno de prueba de concepto y un exploit para CVEs conocidos, estrictamente con fines educativos y de aprendizaje. No utilice estos scripts o técnicas en sistemas que no posea o para los cuales no tenga permiso explícito de prueba...

CVE-2020-5902

CVE-2020-5902 In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote Code Execution RCE vulnerability in undisclosed pages. Proof of concept...

text4shell-exploit

text4shell-exploit A custom Python-based proof-of-concept PoC exploit targeting Text4Shell CVE-2022-42889, a critical remote code execution vulnerability in Apache Commons Text versions 1.10. This exploit targets vulnerable Java applications that use the StringSubstitutor class with interpolation...

Log4J-RCE-Proof-Of-Concept

Log4J-RCE-Proof-Of-Concept CVE-2021-44228 Esta es una prueba de concepto del RCE de log4j. Aquí hay algunos enlaces sobre el CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/apache/logging-log4j2/pull/608...

opsxcq-cve-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

CVE-2025-0868

Penetration Testing Project Report: Exploiting CVE-2025-0868 DocsGPT RCE via JSON Eval 1. Introduction A critical Remote Code Execution RCE flaw CVE-2025-0868 was disclosed on February 20, 2025, in the open-source DocsGPT library, caused by unsafe use of eval when parsing JSON payloads. Key...

log4shell-docker-lab

Log4Shell docker lab for CVE-2021-44228 The components This docker lab makes use of three components, being: The vulnerable spring-boot application An HTTP server that hosts .class files used for remote code execution An LDAP referral server which redirects specific LDAP queries to the HTTP serve...

CVE-2020-2555

CVE-2020-2555 Weblogic com.tangosol.util.extractor.ReflectionExtractor RCE com.supeream.CVE20202555 root@kitploit: / author:Y4er.com gadget: BadAttributeValueExpException.readObject com.tangosol.util.filter.LimitFilter.toString com.tangosol.util.extractor.ChainedExtractor.extract...

CVE-2025-24813-PoC

CVE-2025-24813-PoC Apache Tomcat Remote Code Execution Vulnerability Batch Detection Script CVE-2025-24813 Disclaimer: The vulnerability and its reproduction steps described in this document are for cybersecurity research and educational purposes only. No one shall use the information provided in...