jvmtiAgentLoad-Exploit

Arbitrary code execution via jvmtiAgentLoad Description: Tools and code for generating a malicious JAR to exploit jvmtiAgentLoad Usage: root@kitploit: $ bash createjar.sh Usage: createjar.sh Supported TARGETOS options: linux|windows Linux Target The following command generates a JAR mal.jar that...

Unauthenticated-Remote-Code-Execution-RCE---Poultry-Farm-Management-System-v1.0

Exploit Title: Unauthenticated Remote Code Execution RCE - Poultry Farm Management System v1.0 Date: 24-06-2024 CVE: CVE-2024-40110 EDB-ID: 52053 Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage:...

RCE-RealEstateVIDEOPOC

This repository does not have a README...

MAL-005

MAL-005: Zip Slip in Add Carbon Applications in WSO2 ESB A ZIP file based directory traversal Zip Slip vulnerability was identified in the "Carbon Applications" add feature of WSO2 ESB. Remote code execution may be obtained by writing/overwriting specific files. Why no CVE? The vendor replied tha...

MAL-003

MAL-003: Groovy Security Bypass and Stored XSS in Apache OfBiz A Groovy RCE and XSS have been identified in Apache OfBiz = 18.12.05. Why no CVE? Apache OfBiz does not create CVEs for "post-auth attacks done using demo credentials, notably using the admin user" as mentioned on their security page...

EUVD-2026-70902

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19224

CVE-2026-19224 affects the Hummingbird Performance WordPress plugin in versions prior to 3.21.2 . The vulnerability resides in the Hub Connector component, which fails to restrict a network-wide setting to network administrators , allowing any site administrator on a WordPress multisite network t...

CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

WordPress Hummingbird Performance plugin < 3.21.2 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Hummingbird versions 3.21.2...

CVE-2024-12252

CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - Missing Authorization to File Overwrite/Upload Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and...

CVE-2024-56064

CVE-2024-56064 WP SuperBackup = 2.3.3 - Unauthenticated Arbitrary File Upload Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 2.3.3. This makes it...

MS-SharePoint-July-Patch-RCE-PoC

MS-SharePoint-July-Patch-RCE-PoC PoC for: CVE-2024-38094 CVE-2024-38024 CVE-2024-38023 PoC Video: https://youtu.be/u8mccaakISw...

Gopherus

Gopherus If you know a place which is SSRF vulnerable then, this tool will help you to generate Gopher payload for exploiting SSRF Server Side Request Forgery and gaining RCE Remote Code Execution. And also it will help you to get the Reverse shell on the victim server. And for more information y...

PSTrojanFile

PSTrojanFile Windows PowerShell Filename and Defender Anti-Malware API - Code Execution POC Discovery: John Page aka hyp3rlinx 2019 and revisted 2023 Updated Dec 24, 2023 Bypassing single quotes obstacle in PowerShell for code exec and bonus PS Windows Event log fail! Semicolon and friend "&"...

CTT-Enhanced-CVE-2026-46339-Exploit-Engine

CTT-Enhanced-CVE-2026-46339-Exploit-Engine Un framework Python spécialisé qui exécute une exécution de code à distance non authentifiée via le pont Model Context Protocol MCP de 9Router en déployant une cascade de phases temporelles sur 33 couches, une dispersion de Riemann-Hadamard et un filtre ...

CVE-2024-12877

CVE-2024-12877 GiveWP – Donation Plugin and Fundraising Platform = 3.19.2 - Unauthenticated PHP Object Injection Description The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via...

CVE-2024-12471

CVE-2024-12471 Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator input type="hidden" name="...

CVE-2024-10124-Poc

CVE-2024-10124-Poc The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the tpinstall function in all versions up to, and including, 1.1.1. This makes it...

CVE-2024-9593-Exploit

CVE-2024-9593-Exploit The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 for Time Clock and 1.1.4 for Time Clock Pro via the 'etimeclockwploadfunctioncallback' function. This allows unauthenticated attacker...

wp-file-manager

wp-file-manager WP File Manager 6.9 - Arbitrary File Upload leading to RCE root@kitploit: usage: wp-file-manager.py -h -u URL -f FILE optional arguments: -h, --help show this help message and exit -u URL, --url URL URL of host to check will need http or https -f FILE, --file FILE File of URLS to...