CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

POC-CVE-2016-10033

POC-CVE-2016-10033 First let’s get the Vulnerable application up and running Step 1: Run the following command to retrieve the vulnerable Docker Image from the Docker repository. Command: docker pull vulnerables/cve-2016-10033 Step 2: Running the Docker image in Docker Desktop, exposing port 8080...

CVE-2022-24715

CVE-2022-24715 Icinga Web 2 - Authenticated Remote Code Execution 2.8.6, 2.9.6, 2.10 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

fortinet-fortiweb-cve-2025-64446-58034

Understanding Fortinet FortiWeb Vulnerabilities CVE-2025-64446, CVE-2025-58034 1. Overview Fortinet FortiWeb is a Web Application Firewall WAF device widely deployed in enterprise systems to protect web applications from common threats. Since FortiWeb typically sits at a central protection layer,...

l4s-vulnapp

Log4Shell Vulnerable Applicationl4s-vulnapp This is a potentially vulnerable Java web application containing Log4j2.14.1 affected by log4shellCVE-2021-44228. Verified environment and various versions AdoptOpenJDK 17.0.10+7 Gradle 8.6 Gretty 4.1.2 Apache Tomcat 10.1.15 Apache Log4j Core 2.14.1...

aws__aws-sdk-java_CVE-2022-31159_1-12-2600

AWS SDK for Java The AWS SDK for Java enables Java developers to easily work with Amazon Web Services and build scalable solutions with Amazon S3, Amazon DynamoDB, Amazon Glacier, and more. See the AWS SDK for Java 2.x for how to get started. In Maintenance Mode as of July 31, 2024 The AWS SDK fo...

CVE-2023-23752

Joomla! options Arguments...

CVE-2026-94132

The AcyMailing Enterprise extension for Joomla (versions 1.0.0 – 11.0.5 ) contains a Remote Code Execution (RCE) vulnerability. The root cause is that the mailbox actions in POP3 mode save incoming MIME attachments to the media/com_acym/upload/ directory without performing extension checks. This ...

CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

CVE-2019-11287

CVE-2019-11287: DoS via Heap Overflow in RabbitMQ Web Management Plugin Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is...

CVE-2016-3113

CVE-2016-3113 PoC A proof of concept to exploit the reflected XSS vulnerability in the oVirt web interface RedHat. In this PoC a VM in the oVirt IaaS environment is to be started via the victim's browser session. JS code has been kept simple due to the rush. More Info here:...

Flangvik

Flangvik C POC for CVE-2021-26855 aka ProxyLogon, supports the classically semi-interactive web shell as well as shellcode in…...

Chamilo-LMS-CVE-2023-4220-Exploit

Chamilo LMS CVE-2023-4220 Exploit Overview This script exploits a Remote Code Execution RCE vulnerability in Chamilo LMS versions ≤ v1.11.24. The vulnerability CVE-2023-4220 exists due to unrestricted file upload functionality in the bigUpload.php feature of Chamilo LMS, which allows attackers to...

CVE-2019-5029

CVE-2019-5029 This is a Python script PoC for CVE-2019-5029. It is a RCE for Exhibitor Web UI 1.7.1. How to use Clone this repo git clone https://github.com/yZ1337/CVE-2019-5029.git Execute as follows python3 CVE-2019-5029.py Make sure the request inside the script is the same as the request of t...

ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks

ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread the SIDEEYE backdoor...

CVE-2022-42889

Quickstart root@kitploit: sudo apt install golang To run like Python: root@kitploit: go run main.go arg1 arg2 To build executable: root@kitploit: go build main.go Usage: root@kitploit: non@woa:/program$ go run main.go - Usage: ./program vulnerable/web?param= 'ls -la' To Do: Reverse shell...

EUVD-2026-87690

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

CVE-2023-24249-PoC

CVE-2023-24249 PoC CVE-2023-24249 is an arbitrary file upload vulnerability in laravel-admin v1.8.19. This proof of concept exploits the vulnerability to upload a web shell. The exploit was written to use against the HackTheBox easy machine Usage. Example root@kitploit: python3 CVE-2023-24249.py ...

CVE-2026-49049

CVE-2026-49049 This repository contains a Python-based scanner and proof-of-concept for a vulnerability in the Joomla Helix3 component. The bug is an arbitrary file write issue that can lead to remote code execution RCE when an attacker is able to write a PHP payload into a web-accessible locatio...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...