ScreenConnect-AuthBypass-RCE

How to use I'm using Python3.9 root@kitploit: pip install requests python check.py python batchAdduser.py root@kitploit: python ScreenConnect-AuthBypass-RCE.py -h usage: ScreenConnect-AuthBypass-RCE.py -h -u USERNAME -p PASSWORD -t TARGET -d DOMAIN --proxy PROXY CVE-2024-1708 && CVE-2024-1709 --...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2024-7479_CVE-2024-7481

CVE-2024-7479 & CVE-2024-7481 TeamViewer User to Kernel Elevation of Privilege This repository contains the exploit proof of concept of a vulnerability in TeamViewer that enables an unprivileged user to load an arbitrary Kernel Driver into the system. I would like to thank Zero Day Initiative for...

WebView2-Cookie-Stealer

Entrada de blog Por favor, lea esta entrada de blog para obtener más información. Código fuente Este código es una versión modificada del Código WebView2 de Microsoft. El código actual puede limpiarse y mejorarse mucho. Demostración Ejemplo de inicio Ejemplo de uso Uso Probado en Windows 10 y 11...

CVE-2021-31762

CSRF-to-RCE ..| CVE-2021-31762 |.. Description : Exploiting a Cross-site request forgery CSRF attack to create a privileged user through the Webmin's add users feature then getting a reverse shell through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version...

CVE-2025-31161

CVE-2025-31161 - CrushFTP Authentication Bypass Exploit PoC CVE-2025-31161 - Authentication Bypass CrushFTP 📌 CVE Details ID : CVE-2025-31161 Type : Authentication Bypass Vendor : CrushFTP Impact : Allows unauthenticated attackers to forge a valid CrushAuth token and create a fully privileged adm...

CVE-2020-6287-exploit

CVE-2020-6287-exploit PoC for CVE-2020-6287 The PoC in python for add user only, no administrator permission set. Inspired by @zeroSteiner from metasploit. Original Metasploit PR module: https://github.com/rapid7/metasploit-framework/pull/13852/commits/d1e2c75b3eafa7f62a6aba9fbe6220c8da97baa8 Thi...

CheeseTools

CheeseTools This repository has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them. CheeseExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context ...

CVE-2023-26067

CVE-2023-34362 POCs for credential dumping, reverse shells, and playing music by abusing a command injection, CVE-2023-26067, affecting Lexmark Printers. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...

CVE-2025-6218

CVE-2025-6218 | ZDI-CAN-27198 | ZDI-25-409 - WinRAR Path Traversal - Remote Code Execution RCE Proof of Concept More information: https://www.win-rar.com/singlenewsview.html?&L=0 https://www.cvedetails.com/cve/CVE-2025-6218/ https://www.zerodayinitiative.com/advisories/ZDI-25-409/ RARLAB WinRAR...

OneDev < 4.0.3 - User Access Token Leak

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. id: CVE-2021-21246...

WordPress Restrict User Access <= 2.5 - Cross-Site Scripting

WordPress Restrict User Access – Membership Plugin with Force versions before 2.6 is vulnerable to Reflected Cross-Site Scripting via the 'ruasection' parameter in the admin level edit page. id: CVE-2024-29138 info: name: WordPress Restrict User Access = 2.5 - Cross-Site Scripting author: Shivam...

GestioIP - Reflected Cross-Site Scripting

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ipdojob request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions. id: CVE-2024-50857 info: name: GestioIP - Reflected Cross-Site Scripting author:...

Cisco SSM On-Prem <= 8-202206 - Password Reset Account Takeover

A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem SSM On-Prem could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process...

Ghost CMS - User Enumeration

Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests. id: CVE-2022-41697 info: name: Gho...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution

Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...

WPEngine WPGraphQL 0.2.3 - Unauthenticated User Information Disclosure

An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username. id: CVE-2019-9880 info: name: WPEngine WPGraphQL 0.2.3 -...

YesWiki < 4.6.4 - Unauthenticated SQL Injection

YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bnidnature parameter in FormManager::create is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read th...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...