CVE-2026-63030

🚨 CVE-2026-63030 — WP2Shell WordPress REST API Route Confusion → Remote Code Execution A Critical WordPress Core vulnerability enabling REST API route confusion that can be chained with SQL Injection to achieve unauthenticated Remote Code Execution. 📖 Overview CVE-2026-63030 is a Critical...

cve-2019-1003000-jenkins-rce-poc

PoC：Jenkins RCE SECURITY-1266 / CVE-2019-1003000 Script Security，CVE-2019-1003001 Pipeline: Groovy，CVE-2019-1003002 Pipeline: Declarative 一个概念验证，允许具有 Overall/Read 权限和 Job/Configure（以及可选的 Job/Build）权限的用户绕过沙箱保护，在 Jenkins 主节点或代理节点上执行任意代码。 更新 : 一篇由 Orange Tsai 撰写的文章，解释了利用 CVE-2018-1000861 和...

cve-2025-9951-ffmpeg-jp2-poc

CVE-2025-9951 FFmpeg JPEG 2000 Exploitation Research This repository contains two deliberately separated exploitation milestones for the FFmpeg JPEG 2000 component-mapping vulnerability: 1. 01-gdb-assisted/ — the original deterministic GDB-launched PoC and its full research-journey writeup,...

CVE-2025-32583

🚨 CVE-2025-32583 — WordPress PDF 2 Post RCE Exploit CRITICAL Vulnerability CVE-ID: CVE-2025-32583 Severity: 9.9 CRITICAL CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 📖 Description A vulnerability in the PDF 2 Post WordPress plugin developed by termel allows Remote Code Inclusion RCE...

connectwise-screenconnect_auth-bypass-add-user-poc

CVE-2024-1708 和 CVE-2024-1709 由 @watchTowr 开发的概念验证（PoC），利用身份验证绕过漏洞在 ConnectWise ScreenConnect 中添加新的管理用户。这是简单的远程命令执行链的第一步。 关注 watchTowr 实验室团队，获取我们的安全研究 https://labs.watchtowr.com/ https://twitter.com/watchtowrcyber...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Broken Access Control LiteLLM 's /config/update endpoint does not check the caller's role privileges. Any authenticated user with a valid API Key without admin privileges can modify the proxy configuration, register malicious Pass-Through endpoints to achie...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE While analyzing this vulnerability, I discovered that MCPJam Inspector exposed the /api/mcp/connect endpoint to the network by binding to 0.0.0.0. This endpoint accepts a JSON object containing serverConfig, including the fields command and args. The application...

cve-2017-5941-poc-docker-lab

CVE-2017-5941 — node-serialize Untrusted Deserialization RCE PoC ⚠️ For lab / self-assessment only. Use only on systems you own or are authorized to test. This repository provides: A minimal PoC script to reproduce CVE-2017-5941 against a vulnerable Node.js app that uses node-serialize = 0.0.4. Tw...

CVE-2026-46817

🚨 CVE-2026-46817 - Critical Remote Code Execution Oracle E-Business Suite – Oracle Payments File Transmission Critical unauthenticated remote vulnerability affecting Oracle Payments File Transmission that may allow complete compromise of the application over HTTP. 📌 Overview CVE-2026-46817 is a...

CVE-2025-52970

CVE-2025-52970 FortiWeb Authentication Bypass to Remote Code Execution Exploit Features Weaponized by adding interactive shell to enable remote code execution Usage root@kitploit: python CVE-2025-52970.py -t target.com Demo References...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup root@kitploit: pip3 install -r requirements.txt Run root@kitploit: python3 app.py Attacker Connec...

FUXAPWN

CVE-2026-25895 — FUXA = 1.2.9 Unauthenticated Path Traversal to Remote Code Execution Unauthenticated, pre-auth arbitrary file write against FUXA, a Node.js-based SCADA/HMI platform. Chains to remote code execution via several distinct post-write primitives. Works even when secureEnabled = true...

CVE-2021-46422

CVE-2022-26134RCE Installation root@kitploit: git clone https://github.com/yigexioabai/CVE-2022-26134-cve1.git cd CVE-2022-26134-cve1 pip3 install -r requirements.txt Place CVE-2022-26134RCE.py in the pocsuite3\pocs directory cd pocs Using pocsuite3 Single URL: root@kitploit: pocsuite -r...

react2shell-CVE-2025-55182-full-rce-script

Next.js React2Shell CVE-2025-55182 Exploit Tool A proof-of-concept tool for demonstrating the critical React2Shell vulnerability CVE-2025-55182 / CVE-2025-66478 on authorized, local testing environments only. ⚠️ CRITICAL WARNING: ACTIVE EXPLOITATION This vulnerability CVSS 10.0 is being actively...

CVE-2017-12615-PoC

CVE 2017-12615 Apache Tomcat Windows RCE ⚠️Warning This is a proof of concept environment and exploit for known CVEs, strictly for learning and educational purposes. Do not use these scripts or techniques on systems you do not own or have explicit permission to test. Unauthorised access or...

CVE-2025-6058

🚨 CVE-2025-6058 — WordPress WPBookit ≤ 1.0.4 Unauthenticated File Upload Exploit Unauthenticated Arbitrary File Upload Exploit targeting WordPress WPBookit Plugin ≤ 1.0.4 Exploit allows remote shell upload and full command execution. Author: 0xgh057r3c0n 📌 About The Vulnerability CVE-2025-6058 is...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE. root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host...

WSUS-CVE-2025-59287-RCE

WSUS-CVE-2025-59287-RCE CVE-2025-59287 is a critical CVSS 9.8 remote code execution vulnerability affecting ALL Microsoft Windows Server Update Services aka WSUS, and has been exploited in the wild. The vulnerability exploits insecure deserialization in the GetCookie endpoint, allowing...

CVE-2026-19658

The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software,...

CVE-2021-4034

CVE-2021- A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling...