CVE-2024-21412_Water-Hydra

CVE-2024-21412Water-Hydra Deliver malware via CVE-2024-21412 usage Start the services in order, then access the web server. webserver Start a web server in the folder: python -m http.server Initial Access: Use Windows Advanced Query Syntax AQS to link back to a JPEG trojan hosted on a WebDAV shar...

noSAMBAnoCRY-CVE-2017-7494

noSAMBAnoCRY CVE-2017-7494 Exploit remoto para la vulnerabilidad SAMBA CVE-2017-7494, también conocida como isknowpipename! Detalles Este exploit se divide en 3 partes: Compila la evilLib en las siguientes arquitecturas: x8664, x86 o i686 Encuentra un recurso compartido escribible y sube evilLib ...

netview

= netview Netview is a enumeration tool. It uses with the -d the current domain or a specified domain with the -d domain to enumerate hosts. You can also use the -f if you wish to specify a file with a list of hosts instead. Any hostnames you wish to exclude can be specified in a list with -e. If...

Sassy Social Share <= 3.3.3 - Cross-Site Scripting

The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateorssssharingcount' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-33146

CVE-2026-33146 A public share looked clean in the page tree, but the search endpoint told a different story. In Docmost, restricted child pages hidden from public share viewers could still leak through public share search results. Intro I found this issue while reviewing Docmost , an open-source...

CVE

CVE Writeups for CVE-2025-67586, CVE-2025-67985, CVE-2025-67986 root@kitploit: -------------- CVE-2025-67586 Exploit PoC -------------- Exploit Title: WordPress Plugin 5.2.0 - Broken Access Control Software Link: https://wordpress.org/plugins/highlight-and-share/ Version: Description A broken...

CVE-2025-33053-POC

CVE-2025-33053 - WebDAV Remote Code Execution RCE PoC & C2 Simulation ⚠️ Educational Purposes Only This project demonstrates a proof-of-concept exploiting WebDAV and .url file delivery to achieve realistic remote code execution. It includes a decoy-based executable and a controlled simulation of...

CVE-2019-14223

CVE-2019-14223: Open Redirect in Alfresco Share The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulation the “failure” parameter an attacker can redirect a victim to a malicious website over any protocol the attacker desires E.g. http,...

CVE-2023-5070

CVE-2023-5070 Social Media Share Buttons & Social Sharing Icons = 2.8.5 - Information Exposure Description: The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsisaveexport...

CVE-2026-4480-exploit-poc

Usage: For anonymos login: python3 exploit.py --lhost --lport -t -N it is for anonymous login Login via credentials: python3 exploit.py --lhost --lport -t -u -p root@kitploit: ! Error: the following arguments are required: -s/--sharename Note: if user is anonymous and no password, then just add -...

GHSA-XQ6V-W2XJ-4F44 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2024-55982

CVE-2024-55982 Share Buttons – Social Media = 1.0.2 - Unauthenticated SQL Injection Description The Share Buttons – Social Media plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of...

lnkbomb

Lnkbomb Lnkbomb 用于向不安全的文件共享上传恶意快捷方式文件。该漏洞存在的原因在于 Windows 会查找与快捷方式文件关联的图标文件。该图标文件可以被指向渗透测试人员运行 Responder 或 smbserver 的机器，从而收集 NTLMv1 或 NTLMv2 哈希（具体取决于受害主机的配置）。测试人员随后可以尝试使用 Hashcat 等工具离线破解收集到的哈希，或将其中继到 ntlmrelayx 等工具进行进一步利用。 载荷文件直接上传到测试人员在命令行中指定的不安全文件共享。测试人员还需提供其 IP 地址，该地址会被写入载荷中。 2.0...

lnkbomb

Lnkbomb Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder or smbserver to gather...

CVE-2024-11252-Sassy-Social-Share-XSS

CVE-2023-XXXX: Sassy Social Share Plugin XSS Vulnerability Description This project demonstrates a reflected Cross-Site Scripting XSS vulnerability found in the Sassy Social Share plugin for WordPress. This vulnerability can be exploited via the heateormastodonshare parameter. Usage 1. PoC.html :...

CVE-2017-7494

CVE-2017-7494 Remote root exploit for the SAMBA CVE-2017-7494 vulnerability. Details This exploit is divided in 2 parts: First, it compiles a payload called "implant.c" and generates a library libimplantx32.so or libimplantx64.so that changes to the root user, detaches from the parent process and...

CVE-2024-38077

CVE-2024-38077-EXP 基于伪代码后修复的代码。 有效范围 EXP：Windows Server 2025 POC：08-25 使用 root@kitploit: options: -h, --help show this help message and exit --targetip TARGETIP Target IP, eg: 192.168.120.1 --evilip EVILIP Evil IP, eg: 192.168.120.2 --evildllpath EVILDLLPATH Evil dll path, eg: \smb\evildll.dll...

WinShareEnum

WinShareEnum Windows Share Enumerator download https://github.com/nccgroup/WinShareEnum/raw/master/Info/WinShareEnum.exe running against a range on my local non-domain network, with a few dummy shares. Please remember this is primarily designed for domain-ed / large networks: options: A few thing...

RP_RecordClip_DLL_Hijack

Remote DLL Hijack Vulnerability in Real Player CVE-2022-32291 The Player application which is vulnerable upon starting Real Converter and the Recording Manager are prone to a remote DLL hijack binary planting issue because of unsafe search for unexisting DLLs. To exploit the issue attackers would...

CVE-2026-26336-PoC

CVE-2026-26336 — Alfresco Share Unauthenticated File Read Overview Alfresco Share exposes a /share/page/resource/ endpoint used to serve static resources. In vulnerable versions, this endpoint does not properly restrict path traversal, allowing an unauthenticated attacker to read arbitrary files...