cve-2022-44268

Exploit tailored for HackTheBox Pilgrimage Automatic python script using cve-2022-44268 to add a profile value with a filename from a input filelist in an input file, update the image file upload using a input request.req file from Burpsuite already included of the file upload uploading each...

CVE-2024-7703

CVE-2024-7703 root@kitploit: CVE-2024-7703 Exploit: Stored Cross-Site Scripting XSS via SVG File Upload in ARMember WordPress Plugin Overview This repository contains a proof-of-concept PoC exploit for the vulnerability identified as CVE-2024-7703. The vulnerability affects the ARMember WordPress...

CVE-2022-36067-vm2-POC-webapp

CVE-2022-36067-vm2-POC-webapp Steps to reproduce 1. maybe install vm2 globally first npm -install [email protected] -g 2. run: node index.js 3. visit http://localhost:5000/poc 4. Upload poc file such as poc2.js or code and observe RCE...

Golang-CVE-2021-44077-POC

Golang-CVE-2021-44077-POC This exploit is an unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus msiexec.exe Then, run the exploit. go run CVE-2021-44077.go -u "http://192.168.1.3:8080/" -f "/msiexec.exe" -u is the vulnerable URL -f is your malicious file...

CVE-2023-5360

CVE-2023-5360 CVE-2023-5360 Auto Shell Upload WordPress Royal Elementor 1.3.78 Shell Upload...

CVE-2023-26262

Sitecore 10.3 Authenticated file upload vulnerability Author: Thomas Stern Date: 26/01-2023 Summary It is possible via the import languages functionality to upload and arbitrary file. This file could be a webshell that would allow for execution of code on the server. Step to reproduce For testing...

CVE-2024-50379

CVE-2024-50379 Proof of Concept PoC This repository contains a proof of concept PoC script to exploit CVE-2024-50379 , a vulnerability in Apache Tomcat. The vulnerability is a Time-of-Check Time-of-Use TOCTOU race condition that can lead to remote code execution RCE if the server's configuration...

CVE-2021-42669

CVE-2021-42669 CVE-2021-42669 - Remote code execution via unrestricted file upload vulnerability in the Engineers online portal system. Technical description: A unrestricted file upload vulnerability exists in the Engineers Online Portal system. An attacker can leverage this vulnerability in orde...

spip-cve-2023-27372-rce

SPIP CVE-2023-27372 Unauthenticated RCE Exploit Web Shell Upload This Python script exploits CVE-2023-27372, an unauthenticated remote code execution vulnerability in SPIP CMS versions prior to 4.2.1. It leverages a cache poisoning flaw in the password reset mechanism to upload a web shell and...

CVE-2024-53677

CVE-2024-53677: Apache Struts path traversal to RCE vulnerability A critical security vulnerability, identified as CVE-2024-53677 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution...

CVE-2022-28590

CVE-2022-28590 The original discovery and manual PoC is from tuando243: A Remote Code Execution RCE vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=installtheme. This PoC uploads a simple webshell for further remote code execution. This exploit expects from the server that...

CVE-2022-3992

CVE-2022-3992 Cross-Site Scripting in WonderCMS Description: A cross-site scripting XSS vulnerability in Sanitization Management System v1.0 allows potential attackers to upload arbitrary files via a crafted name into the system logo Fields of the System Info Fields. The cookie has no HttpOnly Fl...

Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Vulnerability Description Crater Invoice is vulnerable to unrestricted file upload with dangerous type due to lack of proper input validation. The Base64Mime checking class can be bypassed by embedding a valid PHP...

cve-2022-29464

cve-2022-29464 Disclaimer root@kitploit: 脚本仅供学习参考，请勿恶意攻击他人网站 如违法乱纪，造成一切后果由使用者自行承担 技术无罪，与作者无关 使用脚本默认同意以上说明！ --Author:lowkey0808 Usage root@kitploit: usage: python3 -u url cve-2022-29464 optional arguments: -h, --help show this help message and exit -u 目标url -s 上传的木马,默认上传内置shell.jsp Direct command...

CVE-2024-10410

Source code Online Hotel Reservation System in PHP/MySQLi with Source Code | SourceCodester Description A high risk vulnerability was found in Online Hotel Reservation System, affecting the upload function of /marimar/admin/modroom/controller.php file. The bypass detection operation of image...

php_code_analysis

this script will scan your code the script can find 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection features 1. fast 2. simple report usage: root@kitploit: python code.py file.php -this will sc...

CVE-2024-29272

CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: root@kitploit: nc -lvnp...

CVE-2025-3515

CVE-2025-3515 CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7 Description: Arbitrary file uploads via drag‑and‑drop‑multiple‑file‑upload-contact‑form‑7 ≤1.3.8.9 allow upload of .phar files, leading to remote code execution in Apache+modphp :contentReferenceoaicite:29index=29...

CVE-2022-31814

pfBlockerNG = 2.1.426 Unauth RCE This script is a proof-of-concept exploit for pfBlockerNG = 2.1.426 that allows for remote code execution. It takes a single target URL or a list of URLs, uploads a shell, executes a command, and then deletes the shell. Requirements This script requires Python 3.x...

CVE-2022-32060

Snipe-IT Version v6.0.2 Vulnerability Explanation: An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file. Attack Vectors: We found a vulnerability file upload, when we upload malicious file...