cve-2023-51385

Verify CVE-2023-51385 First, add the following content to /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p There is a command injection in the .gitmodules file statement root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/bar...

Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report

Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report This repository contains a professional bug bounty report demonstrating the successful exploitation of a Blind SSRF vulnerability that reached an internal CGI endpoint vulnerable to Shellshock CVE-2014-6271. Remote...

session_reaper_lab

CVE-2025-54236 - SessionReaper Lab Docker environment for practical demonstration of CVE-2025-54236 SessionReaper: PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7. Exclusive use in controlled environment. Do not run against systems without explicit authorization. About the...

CVE-2026-85197 Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

EUVD-2026-70953

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

CVE-2026-85197

libsoup contains a heap use-after-free in its HTTP/2 client implementation, specifically in the on_data_read() function. The vulnerability is triggered when a GNOME application uploads a file over HTTP/2 and a malicious server or MITM attacker sends a GOAWAY frame while the file body is still bei...

CVE-2026-85197

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

CVE-2019-11043-Vulnerability

Collaberators: Olaf Madejski, Andrew Masone, Nate Desany PHP-FPM Reverse Tunnel Exploitation & Persistence Demonstration CVE-2019-11043 — Debian PHP-FPM Path Handling Vulnerability Project Overview In October 2019, Debian Security Advisory researchers Emil Lerner and Andrew Danau published a noti...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Remote code execution on the unmodified, stock MariaDB 13.0.1-rc Docker image as uid 999 mysql. Two exploit variants: Variant| File| Requirements| Notes ---|---|---|--- Pure SQL recommended| exploitpuresql.py| a low-priv MariaDB account + TCP| no host access, no docker, ...

Pwn2Own-Auto-2024-CHARX

Pwn2Own Automotive 2024 CHARX Exploit This exploit was submitted successfully against the Phoenix Contact CHARX SEC-3100 during Pwn2Own Automotive 2024. An accompanying blog post covers some of our research process and details on the vulnerabilities found, with a follow-up post on the actual...

Apache-OFBiz-Directory-Traversal-exploit

Apache-OFBiz-Directory-Traversal-exploit تم اكتشاف ثغرة أمنية مصنفة على أنها حرجة Critical في Apache OFBiz حتى الإصدار 18.12.12. تتأثر بهذه المشكلة وظيفة غير معروفة. يؤدي التلاعب بمدخل غير معروف إلى ثغرة اجتياز المسار Path Traversal. يستخدم المنتج مدخلات خارجية لإنشاء اسم مسار Pathname يهدف إلى...

CVE-2026-0073

0-Click RCE on Android Critical vulnerability CVE-2026-0073 in Android ADB, an authentication bypass flaw in the TLS certificate verification of the adbd daemon, specifically in the adbdtlsverifycert function. The TLS certificate verification makes Wireless Debugging accept an attacker as if they...

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 CVSS score: 8.8, has been described as a type confusion bug in V8, Chrome's JavaScript and...

CVE-2026-19224

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2017-12149

CVE-2017-12149 CVE-2017-12149 JBOSS as 6.X إلغاء التسلسل نسخة الصدفة العكسية واجهة رسومية معاد كتابتها بناءً على وضع سطر الأوامر للمؤلف التفاصيل:http://www.cnblogs.com/sevck/p/7874438.html...

CVE-2020-5902-rce-gui

CVE-2020-5902-RCE-Big Vulnerability Exploitation Tool GUI Version v1.0 Tool Usage Instructions For command execution, if the first execution fails, you can try several more times. Batch Target Address Detection Execute Reverse Shell Single Target Address Detection File Upload...

winsos-poc

WinSOS This technique utilizes executables within the WinSxS folder, commonly trusted by Windows, to exploit the classic DLL Search Order Hijacking method. By leveraging these executables, threat actors can execute malicious code within Windows applications without requiring elevated privileges...

CVE-2023-22527-confluence

CVE-2023-22527-confluence Confluence CVE-2023-22527 realworld poc Usage Download bun https://github.com/oven-sh/bun/releases Start ngrok root@kitploit: ngrok tcp 4444 Listen localhost 4444 root@kitploit: nc -nvlp 4444 Run exploit root@kitploit: bun exploit-CVE-2023-22527.js --lhost...

FastJsonAutoTypeBypass

What's this This project is used for studying how to bypass fastJSON AutoType check. Gadget Info Mapping just for fastjson 1.2.47: root@kitploit: package com.FastJson1242; import com.alibaba.fastjson.JSONObject; public class Poc public static void mainString argv String payload ="\n" + " "a": \n"...

GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests

OpenAI on Thursday officially unveiled GPT‑6 Astra , which it described as the "world's most intelligent and aligned model." The development comes days after the artificial intelligence AI company said the model had reached the "Critical" cybersecurity capability threshold under its Preparedness...