CVE-2024-36401-poc

CVE-2024-36401 — GeoServer OGC XPath Injection RCE Exploit für nicht authentifizierte Remote-Codeausführung Remote Code Execution bei GeoServer über die Injektion des OGC-Filterparameters valueReference XPath/JXPath-Auswertung. Haftungsausschluss: Dieses Tool ist ausschließlich für autorisierte...

CVE-2026-6286

Amelia – Booking for Appointments and Events Calendar (WordPress plugin, versions ≤ 2.2) is vulnerable to unauthenticated stored XSS via customer name fields. The AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. A...

EUVD-2026-67465

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2026-5097 wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

EUVD-2026-67466

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-5097

The wpForo Forum plugin for WordPress is affected by an unauthenticated SQL Injection via the 'referer' parameter in all versions up to and including 2.4.17 . The root cause is insufficient escaping on the user-supplied parameter combined with a lack of sufficient preparation on the existing SQL ...

CVE-2026-6286 Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...

CVE-2025-52691-APT-PoC

CVE-2025-52691 PoC: SmarterMail RCE durch beliebigen Datei-Upload APT-erweitert Dies ist ein erweiterter Proof-of-Concept-Exploit PoC für CVE-2025-52691 , eine kritische Schwachstelle in der E-Mail-Server-Software SmarterTools SmarterMail, die nicht authentifizierten Benutzern das Hochladen...

CVE-2017-14980

Exploit-CVE-2017-14980 PoC exploit per CVE-2017-14980 — una vulnerabilità di stack-based buffer overflow in Sync Breeze Enterprise 10.0.28. 📖 Analisi tecnica completa dell'exploit: 👉 https://davigsantana.github.io/posts/buffer-overflow/ Informazioni Questo repository contiene un proof-of-concept...

CVE-2020-14882

CVE-2020-14882 Questo script consente l'esecuzione remota di codice RCE su Oracle WebLogic Server utilizzando una richiesta GET non autenticata. Sfrutta la vulnerabilità CVE-2020-14882. Eseguendo comandi arbitrari, un attaccante può ottenere accesso non autorizzato al server. Dettagli dell'exploi...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — RCE non autenticata in GeoServer Uno studio completo e riproducibile di CVE-2024-36401 , una vulnerabilità di esecuzione remota di codice non autenticata in GeoServer — il server open-source più diffuso per dati geospaziali. Il bug è un'eval injection : tramite i parametri degli...

CVE-2025-31161

CVE-2025-31161 ist eine kritische Schwachstelle mit hohem Schweregrad, die es Angreifern ermöglicht, die Art und Weise zu kontrollieren, wie die Benutzerauthentifizierung durch die CrushFTP Managed File Transfer MFT Software gehandhabt wird. Betroffene Versionen: 10.0.0 bis 10.8.3 und 11.0.0 bis...

CVE-2025-55182

Scanner CVE-2025-55182 Una scanner prova di concetto per CVE-2025-55182 , una vulnerabilità critica di Esecuzione di Codice Remoto RCE non autenticata nei React Server Components RSC. Panoramica Il 3 dicembre 2025 è stata divulgata una vulnerabilità critica che interessa React 19.x e le...

CVE-2025-47812

🚀 Wing FTP Exploit - CVE-2025-47812 Exploit migliorato per Wing FTP Server CVE-2025-47812 - Esecuzione remota di codice non autenticata RCE 🔧 Installazione Clona questo repository ed entra nella directory: root@kitploit: git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 p...

DroidSniper

DroidSniper - Scanner Android Debug Bridge non configurato correttamente 🎯 Questo strumento, DroidSniper, è progettato per rilevare protocolli Android Debug Bridge ADB non configurati correttamente su dispositivi Android. Questi dispositivi sono vulnerabili ad accessi non autorizzati tramite ADB ...

KyoceraCredsDump

KyoceraCredsDump - CVE-2022-1026 Basato sull'exploit originale di Aaron Herndon, @ac3lives Rapid7 - https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/ crediti a Aaron Herndon / https://twitter.com/ac3lives /...

CVE-2025-64446

CVE-2025-64446 FortiWeb Nicht authentifizierte RCE via Path Traversal & CGI-Authentifizierungsumgehung...

CVE-2025-24893

CVE-2025-24893 root@kitploit: Exploit Title: XWiki 15.10.10 - Unauthenticated Remote Code Execution Date: 09/08/2025 Exploit Author: D3Ext Vendor Homepage: https://www.xwiki.org/ Software Link: https://github.com/xwiki/xwiki-platform Version: 15.10.10 Tested on: Kali Linux 2025 CVE: CVE-2025-2489...

CVE-2015-10141

CVE-2015-10141 root@kitploit: Exploit Title: xdebug Unauthenticated Command Execution Exploit Author: D3Ext Vendor Homepage: https://xdebug.org/ Sofware Link: https://pecl.php.net/package/xdebug/2.5.5/windows Version: 2.5.5 Tested on: Kali Linux 2025 CVE: CVE-2015-10141 Spiegazione Una...

CVE-2024-23897-Vulnerabilidad-Jenkins

Ausnutzung der Schwachstelle CVE-2024-23897 in Jenkins Beschreibung der Schwachstelle: CVE-2024-23897 CVE-2024-23897 ist eine kritische Schwachstelle, die in Jenkins entdeckt wurde, einem beliebten Tool für kontinuierliche Integration. Diese Schwachstelle ermöglicht die Remote-Befehlsausführung R...