Lucene search
+L

7149 matches found

Kitploit
Kitploit
added 2026/09/01 1:08 p.m.3 views

oracle-xxe-sqli

oracle-xxe-sqli Automated Oracle CVE-2014-6577 exploitation via SQLi Usage: root@kitploit: oracle-xxe-sqli.py -h -i IP -p PORT --disable-server --custom-headers CUSTOMHEADERS -f PAYLOADFILE url Options positional arguments: url URL to inject. Use as the injection marker, just once. optional...

6.8CVSS6.1AI score0.03528EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.51 views

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

7.5CVSS7AI score0.09803EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.34 views

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

7.5CVSS7.2AI score0.04648EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.53 views

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

7.5CVSS7.2AI score0.22541EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.88 views

LumisXP <10.0.0 - Blind XML External Entity Attack

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XML external entity XXE attacks via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service. id:...

9.1CVSS7.3AI score0.18132EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.83 views

TablePress < 2.4.3 - XXE Injection

The PHPSpreadsheet library used by the plugin is affected by an XXE as the security scanner that prevents XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white spaces. On servers that allow users to upload their own Excel XLSX sheets, Server files...

7.5CVSS5.8AI score0.02799EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.30 views

GeoServer WFS - XXE Processing Vulnerability

GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...

9.9CVSS7.1AI score0.46131EPSS
SaveExploits1References6
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.84 views

Apache Cocoon 2.1.12 - XML Injection

Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML...

7.5CVSS7.1AI score0.72456EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/01 10:50 a.m.99 views

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

7.5CVSS7.1AI score0.25743EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/01 9:14 a.m.3 views

CVE-2024-30043-XXE

CVE-2024-30043-XXE Credit The impact of the vulnerability is limited at present, but thanks to https://x.com/chudyPB for providing a clever bypass idea. https://x.com/chudyPB...

7.5CVSS6.7AI score0.54659EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/01 7:33 a.m.4 views

jdbc-sqlxml-xxe

jdbc-sqlxml-xxe h2-jdbc CVE-2021-23463 https://github.com/h2database/h2database/issues/3195 SQLXML XXE vulnerability reproduction. mysql-jdbc CVE-2021-2471 SQLXML XXE vulnerability reproduction...

9.1CVSS6.8AI score0.07493EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/01 7:19 a.m.3 views

CVE-2021-29447-Authenticated-XXE-WordPress-5.6-5.7

CVE-2021-29447 Authenticated XXE Exploit for WordPress 🎯 A Python PoC to exploit the authenticated XXE vulnerability CVE-2021-29447 in WordPress versions 5.6–5.7 via WAV metadata. It abuses the iXML chunk in WAV files to trigger an Out-of-Band OOB exfiltration of sensitive data—like /etc/passwd,...

7.1CVSS6.7AI score0.85719EPSS
SaveExploits20
Kitploit
Kitploit
added 2026/09/01 6:45 a.m.6 views

sap_igs_xxe

SAP IGS XXE attack CVE-2018-2392 and CVE-2018-2393 This module in Metasploit Framework Documentation Module Vulnerable Application This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities within the XMLCHART page of SAP Internet Graphics Servers IGS running versions 7.20,...

7.5CVSS7.1AI score0.41051EPSS
SaveExploits2References2
Kitploit
Kitploit
added 2026/09/01 5:16 a.m.5 views

Bughound

What is Bughound? Bughound is an open-source static code analysis tool that analyzes your code and sends the results to Elasticsearch and Kibana to get useful insights about the potential vulnerabilities in your code. Bughound has its own Elasticsearch and Kibana Docker image that is preconfigure...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/01 4:59 a.m.7 views

CVE-2022-2414

EN GenXMLExternalEntityExploit is a PoC script for demonstrating an XML External Entity XXE vulnerability exploitation. The script leverages XML payloads to read sensitive files from a target server. This can be useful for security testing, penetration testing, or educational purposes. Features...

7.5CVSS7.1AI score0.85608EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/01 4:51 a.m.6 views

CVE-2024-34102

CVE-2024-34102 POC for CVE-2024-34102 : Unauthenticated Magento XXE and bypassing WAF , You will get http connection on ur webhook root@kitploit: POST /rest/V1/guest-carts/1/estimate-shipping-methods HTTP/2 Host: example.com Accept: application/json, text/javascript, /; q=0.01 Content-Length: 310...

9.8CVSS7.4AI score0.99994EPSS
SaveExploits26
Kitploit
Kitploit
added 2026/09/01 4:50 a.m.6 views

blind-xxe-controller-CVE-2021-29447

Controlador de XXE ciego Creé este controlador al resolver la máquina metatwo en HackTheBox para explotar CVE-2021-29447, que es una vulnerabilidad XXE en WordPress en la librería de medios de las versiones afectadas 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. En ella, un usuario autenticado con capacidad de...

7.1CVSS6.8AI score0.85719EPSS
SaveExploits20
Kitploit
Kitploit
added 2026/09/01 4:37 a.m.4 views

CVE-2021-29447

Installation and Execution Sequence 0. Run Docker root@kitploit: $docker-compose up 1. Execute wordpress.sh Configure the wp-config.php file before installing WordPress. root@kitploit: $docker exec -it -u root wordpress /bin/bash -c "/usr/local/bin/wordpress.sh" 2. Install WordPress Access the...

7.1CVSS6.7AI score0.85719EPSS
SaveExploits20
Kitploit
Kitploit
added 2026/09/01 4:37 a.m.4 views

cve-2025-54988-VulnTikaProject

Apache Tika Vulnerability Testing Project This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction. Prerequisites Have Docker Usage ./start-app.sh or docker compose up -d CVE execution Upload your malicious PDF...

9.8CVSS7.2AI score0.80336EPSS
SaveExploits6References1
Kitploit
Kitploit
added 2026/09/01 4:33 a.m.6 views

CVE-2021-29447-POC

CVE-2021-29447-POC About This script automates the required steps to exploit CVE-2021-29447 in the media upload funnctionality in Wordpress and use it to extract files vi an XXE. Usage root@kitploit: ./generatepayloads.py --help usage: generatepayloads.py -h --local-ip LOCALIP --local-port...

7.1CVSS6.7AI score0.85719EPSS
SaveExploits20
Rows per page
Query Builder