CVE-2016-2098

CVE-2016-2098 Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. Explanation: This issue comes from the usage of the render method on user-supplied data. The method render is usually used to render a page from a template, but render method also allows...

CVE-2021-3129

CVE-2021-3129 Laravel debug rce Usage Execute docker-compse up -d to start the environment. Access port 8888 and click generate key on the homepage to reproduce. A few points about the docker environment: Copied .env.example to .env to enable debug environment Disabled phar.readonly in php.ini...

CVE-2020-16898--EXP-POC

CVE-2020-16898 CVE-2020-16898 Windows TCP/IP Remote Code Execution Vulnerability EXP&POC Reproduction forforever: https://www.cnblogs.com/forforever/p/13846077.html POC CVE-2020-16898Checker-poc Command: Run PowerShell/CMD as administrator root@kitploit: Powershell.exe -ExecutionPolicy UnRestrict...

Zimbra-RCE

Zimbra-RCE Zimbra RCE CVE-2019-9670 root@kitploit: $ ./zimbra.py -h . . \ /|| \ | \ \ \ / / / | |/ | \ \ \ | / \ / | / / | | Y Y \ \ \ | // \ | | \ | \ / |||| / /| / || /\ / / / / / / / / / usage: zimbra.py -h -u URL -d DTD -n PAYLOADNAME -f PAYLOADFILE Zimbra RCE CVE-2019-9670...

cve-2021-20837-poc

cve-2021-20837-poc PoC for the CVE-2021-20837 : RCE in MovableType This vulnerability was discovered with the collaboration of The.Criminal.One. This PoC was developped by him. BLOG POST: https://nemesis.sh/posts/movable-type-0day/...

CVE-2024-5082

Overview This repository contains a Python proof of concept for CVE-2024-5082 , a remote code execution vulnerability in Sonatype Nexus Repository Manager 2. The vulnerability allows a user with sufficient permission to publish a specially crafted Maven artifact and mark it for processing by the...

CVE-2024-11320

CVE-2024-11320 Exploit for Pandora FMS Remote Code Execution CVE-2024-11320...

CVE-2019-15107-Exploit

CVE-2019-15107 Python Exploit This exploit is for CVE-2019-15107 Webmin 1.890-1.920 unauthenticated RCE implemented in Python. Usage root@kitploit: python3 webminExploit.py python3 webminExploit.py 10.200.198.200 10000 whoami python3 webminExploit.py 10.200.198.200 10000 "curl -h"...

VulnerableSpringDataRest

Vulnerable Spring DataRest App This is an intentionally Spring Data REST Application to test and demostrate the CVE-2017-8046 vulnerability and the challenges of testing Command Injection and Remote Code Execution via REST apis It has support for Swagger UI to use with tools where Swagger...

CVE-2025-55763

CVE-2025-55763 Buffer Overflow in the URI parser of CivetWeb 1.16 latest release as of yet. Vulnerable code The crash occurs here in src/civetweb.c during the last strcat marked. Fix See the pull request. PoC The PoC crashes the server performing an heap overflow, however it is possible to achiev...

CVE-2022-46169_poc

CVE-2022-46169 unauthenticated remote code execution Description Authentication Bypass: a hostname-based authorization check is not implemented safely for most installations of Cacti Command Injection: unsanitized user input is propagated to a string used to execute an external command Demo...

CVE-2025-47550

Instantio - Wordpress Plugin 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu...

CVE-2026-87464

A flaw was found in WebGL within Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. Exploitation occurs when a user visits a specially crafted HTML page, leading to a critical security compromise...

CVE-2026-87455

A flaw was found in Aura in Google Chrome. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security sandbox...

CVE-2026-87438

A flaw was found in chromium-browser. An out-of-bounds write vulnerability in the WebGL component of Google Chrome on Android allows a remote attacker to execute arbitrary code outside of the sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page...

CVE-2025-58434-AND-59528-POC

Flowise Dual CVE PoC — CVE-2025-58434 + CVE-2025-59528 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents Overview Vulnerability Details CVE-2025-58434 — Account Takeover...

Codiad-CVE-2018-14009

install codiad @ git clone https://github.com/Codiad/Codiad.git Steps to reproduction 1. Setup a vulnerable environment on ubuntu server with Codiad 2.8.4 latest version root@kitploit: @ chmod o+w config.php @ chmod o+w workspace @ chmod o+w plugins @ chmod o+w themes @ chmod o+w data 2. @ git...

CVE-2022-42092

CVE-2022-42092 Python Exploit 🔥 Description This Python exploit script targets an unrestricted file upload in Backdrop CMS to achieve a Remote Code Execution RCE. ⚠️ Affected Versions Version 1.22.0 and prior version Note: Backdrop CMS disputes this and argues that advanced permissions are...

CVE-2025-55182-exp

CVE-2025-55182-exp 🔥 Overview CVE-2025-55182 is a critical Remote Code Execution RCE vulnerability in React Server Components RSC affecting Next.js applications using App Router with Server Actions. The vulnerability exists in the Flight protocol deserialization process, allowing attackers to...

CVE-2020-14883

http://myq-x.remore:8090/index.php?m=WebServiceMgmt::invoke&p="d":"\\m\":"Wsf\\\\Win\\\\Firewall::delete\","\\p\":"----\\\"|ipconfig+/allC:\\\\Windows\\\\system32\\\\spool\\\\drivers\\\\1.txt||----","\\id\":"1","\\pwd\":"","s":"b75c29ef4a5a3d600d96732b3c5cbed1"...