SmarterMail-CVE-2026-24423

SmarterMail ConnectToHub RCE A Python-based exploit for CVE-2026-24423 , an unauthenticated Remote Code Execution vulnerability in SmarterTools SmarterMail's ConnectToHub functionality. Intended use: Authorized security testing, CTFs, Hack The Box labs, and controlled research environments only...

POC-CVE-2026-0769

Description Usage python3 poc.py -u -c Without bash command proof of code exec via Divide By Zero Error With bash command NOTE: Bash output isn't returned because the endpoint only returns the component template and metadata. The bash output is stored in out within the build scope and isn't...

POC-CVE-2026-0768

Description Proof of concept exploit code for CVE-2026-0768 Usage python3 poc.py -u -c...

Research

Research Zero-day and Exploit code of some applications...

Atmail-exploit-toolchain

AtMail Email Server Appliance 6.4 - Exploit toolchain XSS CSRF RCE PacketStorm WLB-2020080010 Disclaimer: this exploit toolchain was inspired by EDB-ID 20009. Goal The goal of this exploit toolchain is to replace EDB-ID 20009. Pros of this toolchain over EDB-ID 20009 exploit: Simple to use Reusab...

Umbraco-RCE

Umbraco RCE exploit / PoC Umbraco CMS 7.12.4 - Authenticated Remote Code Execution EDB-49488 PacketStorm WLB-2020080012 Usage root@kitploit: $ python exploit.py -h usage: exploit.py -h -u USER -p PASS -i URL -c CMD -a ARGS Umbraco authenticated RCE optional arguments: -h, --help show this help...

OpenEMR-RCE

OpenEMR RCE exploit / PoC OpenEMR --shell --user --password --debug exploit.rb semi-auto --root-url --user --password --payload --lhost --lport --debug exploit.rb auto --root-url --user --password --lhost --lport --debug exploit.rb -H | --help Options: -r , --root-url Root URL base path including...

awesome-jenkins-rce-2019

awesome-jenkins-rce-2019 There is no pre-auth RCE in Jenkins since May 2017, but this is the one! It chains CVE-2018-1000861, CVE-2019-1003005 and CVE-2019-1003029 to a more reliable and elegant pre-auth remote code execution! Affect list ANONYMOUSREAD disable Jenkins version 2.138 ANONYMOUSREAD...

ufuzz

UFuzz, or Universal Plug and Fuzz, is an automatic UPnP fuzzing tool. It will enumerate all UPnP endpoints on the network, find the available services and fuzz them. It also has the capability to fuzz HTTP using Burp proxy logs. It is designed to fuzz embedded systems, and as such, is only single...

dompdf-rce

Exploit RCE pour dompdf Ce dépôt contient une application de démonstration vulnérable utilisant dompdf 1.2.0 ainsi qu'un exploit qui permet l'exécution de code à distance via un fichier polyglotte ttf+php. Pour plus de détails, veuillez consulter https://positive.security/blog/dompdf-rce...

Craft-CMS-3.0.25---Cross-Site-Scripting

Craft-CMS-3.0.25 - Cross-Site Scripting Craft CMS 3.0.25 - Vulnerabilidad de Cross-Site Scripting CVE-CVE-2018-20418 https://vulners.com/cve/CVE-2018-20418 Prueba de concepto Permite ejecutar un Cross-Site Scripting al guardar un nuevo título desde la pestaña de la consola. root@kitploit: POST...

Watchguard_WebUI_Unpacker

Watchguard Fireware Web UI update unpacker unpackwatchguard is a tool that unpacks this file format sysa-dl. watchguardsysadl.ksy contains Kaitai description of Watchguard Fireware web update file format. Info This update format is used by WatchGuard Firebox firewalls. The unpacker has been teste...

pwn2own2018

Pwn2Own 2018 : Safari + macOS RCE sur Safari, évasion du sandbox et LPE jusqu'au noyau pour macOS 10.13.3. Utilisation Installez nasm et tornado : root@kitploit: brew install nasm pip3 install tornado Consultez config.py si vous souhaitez changer l'hôte ou les ports. Démarrez ensuite le serveur...

pwn2own2018

Pwn2Own 2018: Safari + macOS Safari RCE, sandbox escape, and LPE to kernel for macOS 10.13.3. Usage Install nasm and tornado: root@kitploit: brew install nasm pip3 install tornado Check config.py if you want to change the host or ports. Afterwards start the server with ./server.py and navigate to...

QuickBox-Pro-2.1.8-Authenticated-RCE

QuickBox-Pro-2.1.8-Authenticated-RCE An authenticated low-privileged user can exploit a command injection vulnerability to get code-execution as www-data and escalate privileges to root due to weak sudo rules. QuickBox Pro v2.1.8 and prior is vulnerable...

noise-java

Noise-Java Library Noise-Java is a plain Java implementation of the Noise Protocol, intended as a reference implementation. The code is distributed under the terms of the MIT license. This library is written in plain Java, making use of the Java Cryptography Extension JCE to provide cryptographic...

Exploit-CVE-2023-6063-PoC-Vuln

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC -red Proof of Concept PoC for CVE-2023-6063 , an unauthenticated, time-based blind SQL injection vulnerability affecting WP Fastest Cache ≤ 1.2.2. The vulnerability can be triggered through the wordpressloggedin cookie and may allow an attacker t...

0xCr0ssCrush

0xCr0ssCrush Two signed drivers. One dangerous kernel primitive. 0xCr0ssCrush is a Windows BYOVD research project covering the DCRCVDrv.sys and Alinubx.sys drivers abused by the Cruciferra malware-as-a-service loader: their interfaces, their kernel primitives, their provenance, and how to detect...

CVE-2026-92838

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If...

CVE-2026-81546

The Affinity by Canva application before 3.3.0 September 2026 release did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in...