fusionpbx_rce_vulnerability

Prelude This simple code tries to complete the implementation of the chained vulnerability introduced by Dustin Cobb at RCE Using Caller ID – Multiple Vulnerabilities In FusionPBX. RCE Reproduction Steps 1. View the vulnerable operator screen in a web browser, located in this example at...

CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE Exploit Exploit Title: Wing FTP Server 7.4.4 Remote Code Execution via Lua Injection CVE: CVE-2025-47812 Tested on: Wing FTP Server v7.3.x Windows/Linux Impact: Remote Code Execution RCE as SYSTEM/root Severity: Critical Description A vulnerability in Wing FTP...

parquet-avro-rce

This repository does not have a README...

Larascript

root@kitploit: | | | | | | / || '| / |/ | / || '|| || ' \ | | | | | | || | | | |\ | | | | || | || | || ,||| ,||/ ||| ||| ./ | || Authors: @pwnedshell & @rsgbengi 📌 What its Larascript? Larascript is a script which take advantage from CVE-2018-15133 and can execute remote commands if a...

CVE-2014-0094

CVE-2014-0094 For verification. Refer to https://piyolog.hatenadiary.jp/entry/20140417/1397750197, vulhub/java:7u55-jdk tomcat-8.0.5 struts-2.3.16 reproduced. The classLoader is working, but the crucial log is percent-encoded, so it does not lead to RCE Windows version also added but only 7u191...

CVE-2025-1094-Exploit

CVE-2025-1094: SQL Injection to RCE via WebSocket 🚀 This repository contains a proof of concept PoC exploit for CVE-2025-1094 , a vulnerability in PostgreSQL that allows an SQL Injection SQLi attack to escalate to Remote Code Execution RCE through WebSocket hijacking. Overview This exploit...

CVE-2020-0601

ChainOfFools AKA CurveBall AKA CVE-2020-0601 Collection of CVE-2020-0601 ChainOfFools | CurveBall resources General A summary from the NSA advisory states. NSA has discovered a critical vulnerability CVE-2020-0601 affecting Microsoft Windows®1 cryptographic functionality. The certificate validati...

CVE-2023-36159

CVE-2023-36159 Cross Site Scripting XSS vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page...

CVE-2024-5246

Here’s a structured README.md for the NETGEAR ProSAFE Network Management System Remote Code Execution RCE vulnerability PoC: Proof of Concept PoC for Remote Code Execution in NETGEAR ProSAFE Network Management System This repository contains a Proof of Concept PoC script demonstrating a Remote Co...

CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content

Quick CMS Stored XSS v6.7 Author: Sergio Description: A Cross-Site Scripting XSS vulnerabilitie in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the Content - Name in the Pages Menu. Attack Vectors: Scripting A vulnerability in the sanitization of...

CVE-2022-22965-poc

CVE-2022-22965 poc CVE-2022-22965 poc including reverse-shell and password support. Feel free to add more stuff : How to test? root@kitploit: $ docker run -p 9090:8080 vulfocus/spring-core-rce-2022-03-29 run vulnerable docker $ python3 exploit.py -c id --password 1234 --shellname big0us $ python3...

CVE-2025-8088

Security Analysis: Path Traversal Exploitation in WinRAR CVE-2025-8088 Note: Repository under development. This project will receive future updates with additional analyses, analysis scripts non-exploit, and presentation material. New versions will be published as soon as they are available. This...

CVE-2022-36067-vm2-POC-webapp

CVE-2022-36067-vm2-POC-webapp Steps to reproduce 1. maybe install vm2 globally first npm -install [email protected] -g 2. run: node index.js 3. visit http://localhost:5000/poc 4. Upload poc file such as poc2.js or code and observe RCE...

ADSelfService-Plus-RCE-CVE-2021-40539

ADSelfService-Plus-RCE-CVE-2021-40539 ADSelfService Plus RCE Vulnerability Detection Tool Fork Description ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. Network Mapping...

CVE-2024-52380-Exploit

CVE-2024-52380-Exploit Picsmize plugin for WordPress is vulnerable to arbitrary file uploads. Description This script exploits a vulnerability CVE-2024-52380 in the Picsmize plugin for WordPress, allowing unauthenticated attackers to perform arbitrary file uploads. This vulnerability exists in al...

CVE-2012-1823

PHP CGI Argument Injection CVE-2012-1823 Description sapi/cgi/cgimain.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to execute arbitrary code by...

cve-2025-64446-fortiweb-exploit

CVE-2025-64446 Fortinet FortiWeb Path Traversal RCE Exploit A security research tool for detecting and testing the CVE-2025-64446 vulnerability in Fortinet FortiWeb Web Application Firewall WAF. This critical zero-day path traversal vulnerability has been actively exploited in the wild and allows...

CVE-2023-51409

CVE-2023-51409 AI Engine: ChatGPT Chatbot = 1.9.98 - Unauthenticated Arbitrary File Upload via restupload Description: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the...

CVE-2024-50379

CVE-2024-50379 Proof of Concept PoC This repository contains a proof of concept PoC script to exploit CVE-2024-50379 , a vulnerability in Apache Tomcat. The vulnerability is a Time-of-Check Time-of-Use TOCTOU race condition that can lead to remote code execution RCE if the server's configuration...

CVE-2022-0543

CVE-2022-0543 Fully featured exploit for Redis RCE through Lua Sandbox Escape vulnerability. Based on https://thesecmaster.com/how-to-fix-cve-2022-0543-a-critical-lua-sandbox-escape-vulnerability-in-redis/. Features: Automatic reverse shell -I + -P Single command execution -x Basic shell Default ...