CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2021-39409

CVE-2021-39409 Admin account registration is possible in Online Student Rate System v1.0, allowing a malicious actor to create an admin account and access the admin panel. Vulnerability root@kitploit: POST /ajax.php?action=signup HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664;...

CVE-2020-29669

=============== Macally WIFISD2-2A82 Writeup for CVE-2020-29669 by Maximilian Barz Silky and Daniel Schwendner code-byter ========================== This is a writeup of exploiting the Macally WIFISD2-2A82 Travel Router Firmware version: 2.000.010. The Guest user is able to reset its own password...

From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack

From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack It shook the world in 2017 and has evolved into today’s CVE‑2025‑2776. Microsoft still relies on SMBv1, this article will explain how attackers have tweaked the chain from a simple DLL to a full reverse‑shell stack, and what that...

Jquery-File-Tree-1.6.6-Path-Traversal

Jquery-File-Tree-1.6.6-Path-Traversal Jquery File Tree 1.6.6 路径遍历漏洞利用（CVE-2017-1000170） WordPress 的 jQueryFileTree 这将在 victim.com/backup/admin 及其子路径中搜索所有 .zip 和 .sql 文件 （必须提供点号以指示它是扩展名） xpljqueryFileTree.php -u victim.com -f .log,idrsa -a -r | - 这将在服务器的所有文件夹中搜索所有名为 "idrsa" 或扩展名为 ".log" 的文件，...

CVE-2024-8349-and-CVE-2024-8350

CVE-2024-8349 and CVE-2024-8350 Background information Uncanny Groups for LearnDash uncanny-learndash-group is a third-party plugin for LearnDash LMS sfwd-lms. The plugin lets Group Leaders custom LearnDash role manage users of their own LearnDash groups from the frontend. Group Leaders can add...

h4rpy

h4rpy h4rpy is an automated WPA/WPA2 PSK attack tool, wrapper of aircrack-ng framework. h4rpy provides clean interface for automated cracking of WPA/WPA2 PSK networks. h4rpy enables monitor mode on selected wireless interface, scans the wireless space for access points, tries to capture WPA/WPA2...

droopescan

droopescan A plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume n...

CVE-2018-14667-poc

CVE-2018-14667-poc Richfaces Vulnerability Environment and PoC Target Range: Deploy the war package under vulenvironment directly into tomcat PoC root@kitploit: build:build artifactId run:java -jar CVE-2018-14667-poc.jar "cmd" about debug Directly extract the war under the vulenvironment's war...

CVE-2021-37580

CVE-2021-37580 CVE-2021-37580 的 poc 0x00 漏洞原理 漏洞原理： Apache ShenYu Admin bypass JWT authentication CVE-2021-37580 0x01 单个url root@kitploit: Usage: python3 CVE-2021-37580.py -u url -n username.txt shenyu-admin-2.4.0的，有漏洞的如下： shenyu-admin-2.4.1的，没有漏洞的如下： 0x02 批量url检测 root@kitploit: Usage: python3...

CVE-2018-8120

CVE-2018-8120 Exploit de LPE para Windows del CVE-2018-8120 Compatible con x32 y x64. Probado en: Win7 x32, Win7 x64, Win2008 x32, Win2008 R2 x32, Win2008 R2 x64. Uso root@kitploit: CVE-2018-8120 exploit by @unamerhttps://github.com/unamer Usage: exp.exe command Example: exp.exe "net user admin...

Magento-CVE-2016-4010

Magento未授权远程代码执行漏洞CVE-2016-4010的分析与利用 0x00 前言 5月17日，国外的安全研究人员Netanel Rubin公开了Magento的一个未授权远程代码执行漏洞（CVE-2016-4010）。该漏洞实际上包含了多个小的漏洞并且允许攻击者在有漏洞的Magento服务器上未授权执行PHP代码。Magento是一个非常流行的电商平台，它在2011年时被eBay收购。一些知名企业，如：三星，尼康，联想，以及众多的小型电商都在使用它。据悉，Magento被250,000个在线商城使用，每年将涉及金额达600亿美金。 0x01 分析 该漏洞的利用条件：...

CVE-2021-3560

CVE-2021-3560 Polkit - Local Privilege Escalation Original discovery by kevinbackhouse from GitHub Security Lab References https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/ https://www.youtube.com/watch?v=QZhz64yEd0g https://ubuntu.com/security/CVE-2021-3560 Blog...

sap_igs_xxe

SAP IGS XXE attack CVE-2018-2392 and CVE-2018-2393 This module in Metasploit Framework Documentation Module Vulnerable Application This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities within the XMLCHART page of SAP Internet Graphics Servers IGS running versions 7.20,...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

CVE-2023-0386

typora-copy-images-to: ./image CVE-2023-0386 Exp Usage: First ：Upload fuse.c and exp.sh to the /tmp directory. You can use scp or python3 -m http.server upload the file to target. root@kitploit: scp /Desktop/CVE-2023-0386/exp.sh [email protected]:/tmp scp /Desktop/CVE-2023-0386/fuse.c...

CVE-2020-5902

CVE-2020-5902 In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote Code Execution RCE vulnerability in undisclosed pages. Proof of concept...

CVE-2023-36899

CVE-2023-36899 Reproduction environment and tooling for CVE-2023-36899, a cookieless session authentication bypass in the ASP.NET framework. Cookieless DuoDrop: IIS Auth Bypass & App Pool Privesc in ASP.NET Framework CVE-2023-36899 In modern web development, despite cookies being the preferred...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

CVE-2026-45321-Tanstack

Supply Chain Attack Simulation — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer This project is created only for: cybersecurity learning, defensive security research, local lab simulation, understanding t...