Lucene search
+L

96 matches found

Kitploit
Kitploit
added 2026/09/16 2:06 a.m.12 views

CVE-2024-40711

CVE-2024-40711 Exploit for Veeam backup and Replication Pre-Auth Deserialization CVE-2024-40711 See our blog post for technical details https://github.com/user-attachments/assets/24e8122c-3e84-408b-87a9-684a9aabeb70 PoC in Action root@kitploit: CVE-2024-40711.exe -f binaryformatter -g Veeam -c...

9.8CVSS8.8AI score0.90369EPSS
SaveExploits3References1
Kitploit
Kitploit
added 2026/09/15 11:46 p.m.14 views

CVE-2025-59287

In this study, we will examine a critical vulnerability CVE-2025-59287 discovered in the Microsoft Windows Server Update Services WSUS environment. This vulnerability arises from the unsafe deserialization of AuthorizationCookie objects sent to the GetCookie endpoint, where encrypted cookie data ...

9.8CVSS8.2AI score0.9998EPSS
SaveExploits24
Kitploit
Kitploit
added 2026/09/15 1:53 p.m.7 views

CVE-2024-40711-Exp

Usages root@kitploit: .\ysoserial.exe -f BinaryFormatter -g Veeam -c localhostServer -vi targetIP -vp 6170 -vg DataSet -vc "cmd /c mspaint.exe" root@kitploit: Usage: ysoserial.exe options Options: --vi, --targetveeamip=VALUE The target Veeam Backup and reaplication IP address --vp,...

9.8CVSS8.8AI score0.90369EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/15 1:35 p.m.7 views

CVE-2026-50522

CVE-2026-50522 PoC:SharePoint 反序列化 RCE 通过 SecurityContextToken Cookie 反序列化实现 SharePoint Server 未经身份验证的远程代码执行 针对本地部署的 Microsoft SharePoint Server 的 CVE-2026-50522 批量扫描漏洞利用工具。利用 /trust/default.aspx WS-Federation 端点中不安全的 BinaryFormatter 反序列化,通过精心构造的 SecurityContextToken cookie 实现未经身份验证的代码执行。 注意: 此项目...

9.8CVSS8.2AI score0.854EPSS
SaveExploits4References1
Kitploit
Kitploit
added 2026/09/15 9:54 a.m.8 views

CVE-2025-53691

CVE-2025-53691: Remote code execution RCE through insecure deserialization The same reflection mechanism in the AjaxScriptManager can be used to invoke the ProcessSerializedData method. This method deserializes a provided payload using the insecure BinaryFormatter, leading to RCE. An attacker can...

8.8CVSS7.1AI score0.01544EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/15 6:57 a.m.10 views

sharepoint-2026-poc

SharePoint /trust WS-Federation Deserialization: PoC & Detection Notes Live writeup GitHub Pages: https://sp-poc.wismansec.com/ HTML rendering of this document. Affected: SharePoint Server 2016, 2019, and Subscription Edition. Reconstruction of a SharePoint Server Subscription Edition intrusion i...

5.9AI score
SaveExploits0
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.23 views

Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE

Microsoft SharePoint Server 2016, 2019, Subscription Edition = 2026.3.1 contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint /trust/default.aspx. The SharePoint authentication module SPFederationAuthenticationModuleV2 uses a deflate-only...

9.8CVSS8.5AI score0.15873EPSS
SaveExploits1References6
Kitploit
Kitploit
added 2026/09/14 3:41 p.m.5 views

SharePoint-CVE-2025-53770-POC

OurSharePoint - CVE-2025-53770 PoC This is a simple C tool that builds a GZipped, Base64-encoded .NET DataSet payload using a LosFormatter-encoded inner payload. It's designed to help reproduce the SharePoint deserialization RCE chain described in public research. What it does You give it a...

9.8CVSS8.2AI score0.99998EPSS
SaveExploits42References2
Kitploit
Kitploit
added 2026/09/12 1:43 a.m.13 views

CVE-2025-59287-WSUS-2

CVE-2025-59287 ⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited. CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services WSUS. It stems from unsafe deserializatio...

9.8CVSS9.1AI score0.9998EPSS
SaveExploits24
Kitploit
Kitploit
added 2026/09/11 10:01 p.m.13 views

GadgetToJScript

Description A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA scripts. The current gadget triggers a call to Activator.CreateInstance when deserialized using BinaryFormatter from jscript/vbscript/vba...

5.8AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/11 3:27 a.m.23 views

CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit

CVE-2026-56158 — .NET Framework Remote Code Execution RCE PoC Exploit Critical CVSS 9.8 — Deserialization of Untrusted Data CWE-502 in Microsoft .NET Framework & .NET Runtime Patched: July 14, 2026 | Attributed to: Positive Technologies PT-2026-60174 Table of Contents Overview Vulnerability Detai...

6.7AI score
SaveExploits1
Kitploit
Kitploit
added 2026/09/10 12:00 a.m.7 views

cve-2025-59287-exploit-poc

CVE-2025-59287 Proof-of-Concept Exploit Vulnerability Overview CVE-2025-59287 is a critical Remote Code Execution RCE vulnerability in Microsoft Windows Server Update Services WSUS. The vulnerability is caused by unsafe deserialization of AuthorizationCookie data through BinaryFormatter in the...

9.8CVSS8.6AI score0.9998EPSS
SaveExploits24
GithubExploit
GithubExploit
added 2026/07/26 4:27 p.m.82 views

sharepoint-2026-poc

SharePoint /trust WS-Federation Deserialization — PoC & Det...

9.8CVSS7.7AI score0.15873EPSS
SaveExploits1
Vulnrichment
Vulnrichment
added 2026/06/04 5:20 p.m.14 views

CVE-2026-25551 Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack...

8.5CVSS6AI score0.00132EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/03/06 2:37 p.m.13 views

CVE-2026-27749

Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramData using .NET BinaryFormatter without...

8.5CVSS6.2AI score0.00323EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/03/05 3:30 p.m.21 views

EUVD-2026-9821

Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\ProgramData using .NET BinaryFormatter without...

8.5CVSS6.5AI score0.00323EPSS
SaveExploits0References5
NVD
NVD
added 2026/03/05 3:16 p.m.30 views

CVE-2026-27749

Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\ProgramData using .NET BinaryFormatter without...

7.8CVSS0.00323EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/03/05 2:15 p.m.6 views

CVE-2026-27749 Avira Internet Security System Speedup Insecure Deserialization

Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\ProgramData using .NET BinaryFormatter without...

8.5CVSS6.2AI score0.00323EPSS
SaveExploits0References4
GithubExploit
GithubExploit
added 2026/02/18 8:36 a.m.234 views

Exploit for CVE-2026-26221

📡 Hyland OnBase Timer Service Unauthenticated RCE Mohamm...

10CVSS7.1AI score0.01162EPSS
SaveExploits1
GithubExploit
GithubExploit
added 2025/10/25 2:30 a.m.312 views

Exploit for CVE-2025-59287

In this study, we will examine a critical vulnerability CVE-202...

9.8CVSS8.2AI score0.9998EPSS
SaveExploits24
Rows per page
Query Builder