cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

CVE-2024-53677

CVE-2024-53677: Apache Struts path traversal to RCE vulnerability A critical security vulnerability, identified as CVE-2024-53677 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code execution...

MAL-2026-16006 Malicious code in vishal_312pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74d38dada8ec3921b4a3f69e7d44b5f5b54d345ff8f9581d34007a3e68679da4 package.json declares a preinstall lifecycle script that runs on npm install and issues a wget request to...

XSS2Shell-CVE-2026-64638

CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Theft + REST API Plugin Activation = Full RCE ⚡ Overview CVE-2026-64638 is a critical pre-authentication Reflected XSS in WordPress wp-login.php. The vulnerability exist...

CVE-2018-9276

CVE-2018-9276 — PRTG Network Monitor ⚠️ Aviso: Esta herramienta tiene fines educativos y solo para pruebas de penetración autorizadas. Úsala únicamente contra sistemas que poseas o para los que tengas permiso explícito por escrito. El uso no autorizado es ilegal. Tabla de contenidos Descripción...

CVE-2025-64087-SSTI-

CVE-2025-64087 SSTI FreeMarker Server-Side Template Injection SSTI in XDocReport allows Remote Code Execution via Apache FreeMarker engine Bug Definition Overview of the vulnerability Server-Side Template Injection SSTI is a web security vulnerability that allows attackers to inject malicious cod...

CVE-2025-55182

CVE-2025-55182 Next.js RCE Exploit Tool 🚀 This is an automated Proof-of-Concept PoC tool for the Next.js React Server Components CVE-2025-55182 Remote Code Execution RCE vulnerability. The tool integrates an interactive Shell , intelligent protocol detection , and multi-threaded batch scanning...

EUVD-2026-72113

wger before 2.6 fails to sanitize firstname and lastname fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or execute code when admins open the exported file in Excel or...

CVE-2025-13486

CVE-2025-13486 exploit ACF Extended WordPress Plugin — Remote Code Execution & Privilege Escalation Exploit for the CVE-2025-13486 discovered by Marcin Dudek dudekmar ⚠️ Disclaimer This repository is provided for research and defensive security purposes only. The author assumes no responsibility...

CVE-2025-68613-Python-Exploit

CVE-2025-68613: n8n Workflow Expression RCE Proof of Concept PoC exploit for a critical Remote Code Execution vulnerability in the n8n workflow automation platform. Description The vulnerability exists in the n8n expression evaluation system. User-supplied expressions are not properly sandboxed,...

react2shell-CVE-2025-55182

React2Shell Exploit CVE-2025-55182 Python exploit for Next.js React Server Components RCE vulnerability with HTTP/HTTPS support. 🚀 Quick Start root@kitploit: Clone & run git clone https://github.com/BrianLopezM99/react2shell-CVE-2025-55182.git cd react2shell-CVE-2025-55182 python3...

-CVE-2025-8088

-CVE-2025-8088 POWERSHEL script to check if your device is affected or no 🚨 CVE-2025-8088: WinRAR Zero-Day Alert! 🚨 A critical WinRAR vulnerability CVE-2025-8088 is making headlines – attackers can exploit this flaw in versions 7.13 to execute malicious code just by tricking users into opening a...

CVE-2024-25082_CVE-2024-25081

⚠️ FontForge RCE — CVE-2024-25081 & CVE-2024-25082 - PoC 📖 Overview Proof-of-concept exploit for two command injection vulnerabilities in FontForge ≤ 20230101 Splinefont component...

cve-2025-48384-poc

PoC for CVE-2025-48384 See CVE-2025-48384 To run: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules [email protected]:liamg/CVE-2025-48384.git Example output: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules CVE-2025-48384 test Cloning int...

CVE-2024-53900

CVE-2024-53900 - Mongoose populate.match $where RCE This repository provides a reproducible vulnerable environment and PoC for CVE-2024-53900 , a critical Remote Code Execution RCE vulnerability in Mongoose 8.8.3. 📌 Vulnerability Details CVE : CVE-2024-53900 Affected : Mongoose 8.8.3 Severity :...

FlowiseAI-Critical-KillChain

FlowiseAI — Critical Kill Chain Unauthenticated Account Takeover chained with Remote Code Execution against FlowiseAI Full container compromise in under 5 seconds , zero credentials required. Kill Chain...

CVE-2025-15556-Notepad-WinGUp-Updater-RCE

Software afectado: Versiones de Notepad++ anteriores a la 8.8.9 que usan el actualizador WinGUp. Tipo de vulnerabilidad: Omisión de la verificación de integridad de actualización que conduce a la ejecución arbitraria de código. Descripción: El actualizador WinGUp no verifica adecuadamente la...

CVE-2025-13486

🔴 CVE-2025-13486 - Advanced Custom Fields Extended ACFE WordPress Plugin Exploit 📋 Overview Proof-of-concept exploit for CVE-2025-13486 , a critical vulnerability in the Advanced Custom Fields: Extended ACFE WordPress plugin that allows Remote Code Execution leading to Privilege Escalation. 🎯...

cve-2026-82222-poc

CVE-2026-82222 Unauthenticated PHP object injection to RCE in GiveWP = 4.16.7.1. Patched in 4.16.7.2...

CVE-2022-22980

SpEL RCE Exploit - CVE-2022-22980 Exploit for remote code execution RCE on Spring Data via SpEL injection Spring Expression Language. Descriptions Vulnerability The box exposes an endpoint /search that accepts a trackingid parameter vulnerable to SpEL injection. This injection allows the executio...