CVE-2025-3248-Langflow-RCE

mitsec - CVE-2025-3248 Langflow RCE Exploit Remote Code Execution RCE exploit for Langflow applications vulnerable to CVE-2025-3248. Affected Endpoint: /api/v1/validate/code 🚀 Exploit Features Remote and unauthenticated RCE No authentication required Python3 one-liner script Colorized terminal...

USN-8771-1 valkey vulnerabilities

Madelyn Olson discovered that Valkey incorrectly handled TLS connections under certain conditions. A remote attacker could possibly use this issue to cause Valkey to crash, resulting in a denial of service, or execute arbitrary code. CVE-2026-56684 It was discovered that Valkey incorrectly handle...

CVE-2014-8731-PoC

CVE-2014-8731-PoC - PHPMemcachedAdmin Remote Code Execution I do not host in Github anymore, but on my own Git hosting instance. Go here to see code: https://git.sbani.net/sbani/CVE-2014-8731-PoC...

CVE-2022-41544

CVE-2022-41544 Exploit script for CVE-2022-41544 - RCE in get-simple CMS Usage Usage: python3 CVE-2022-41544.py Example...

CVE-2026-24061_POC

CVE-2026-24061 GNU Telnetd（远程代码执行） 脚本参数 参数| 描述| 默认值| 是否必需？| 示例 ---|---|---|---|--- -ip| 指定连接的目标 IP 地址。| -| 是| -ip 192.168.1.10 -u| 指定 Telnet 连接的用户名。| root| 否| -u admin -p| 指定 Telnet 连接的端口。| 23| 否| -p 2323 法律免责声明： 本概念验证（PoC）仅供教育目的使用。 其设计旨在演示系统中存在的漏洞， 并帮助安全专业人员、研究人员和开发人员理解 该漏洞的工作原理。 通过使用或分发此...

Exploit-CVE-2024-23897

Exploit-CVE-2024-23897 Run the Container docker run -p 8080:8080 --name vulnerable-jenkins -d jenkins/jenkins:2.441-jdk17 Check logs docker logs Fetch docker machines IP: docker inspect vulnerable-jenkins | grep IPAddress Exploitation Code: python3 exploit.py --target http://127.0.0.1:8080 --file...

CVE-2026-78088

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...

CVE-2023-41892

CVE-2023-41892 - Craft CMS Remote Code Execution RCE referensi: https://github.com/advisories/GHSA-4w8r-3xrw-v25g https://securityonline.info/craft-cms-fixes-rce-cve-2023-41892-flaw-rated-10-out-of-10-on-severity-scale/ https://blog.calif.io/p/craftcms-rce...

CVE-2025-61882-CVE-2025-61884

CVE-2025-61882 & CVE-2025-61884 EDIT: Oracle just disclosed a new vulnerability CVE-2025-61884, the detection script for that vuln can be found in this repo or originally here:https://gist.github.com/rxerium/6c70bc6b72fc0d1365c85937d35d9550. As quoted from Oracle's security advisory: This Securit...

CVE-2023-36845

CVE-2023-36845 Usage? bash cve.sh yourfile.txt Referensi: https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=enUS...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ RCE 通过 Jolokia API 描述 CVE-2026-34197 是 Apache ActiveMQ Classic 中的一个远程代码执行（RCE）漏洞，允许攻击者通过 Web 控制台中暴露的 Jolokia API 在服务器操作系统上执行任意命令。 该漏洞已存在超过 13 年，源于多个组件之间的交互：Jolokia（HTTP-JMX 桥接）、ActiveMQ 的 MBeans、网络连接器和 VM 传输。 漏洞信息...

CVE-2024-8232

CVE-2024-8232 – SpiderControl SCADA Web Server File Upload Vulnerability Summary SpiderControl SCADA Web Server is vulnerable to unauthenticated arbitrary file uploads, allowing attackers to upload malicious scripts e.g., web shells and gain remote code execution. CVE ID : CVE-2024-8232 Vendor :...

CVE-2018-11235

CVE-2018-11235 Getting started To build the Docker containers, use: root@kitploit: make docker The following make commands must be run in parallel on different terminals from your machine To start the attacker server container, use: root@kitploit: make runserver to start the victim container, use...

-CVE-2023-46450

-CVE-2023-46450 Description Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting XSS via the Add supplier function. Additional Information A video POC stored XSS vulnerability exists in the add supplier functionality in free and open source...

CVE-2023-0669-Analysis

CVE-2023-0669 This Repo contain the pcakages and scripts used in this Analysis https://www.vicarius.io/vsociety/blog/unauthenticated-rce-in-goanywhere The vulnerable version of GoAnywhere for Linux https://www.dropbox.com/s/j31l8lgvapbopy3/ga703linuxx64.sh?dl=0...

CVE-2022-45701

CVE-2022-45701 Arris Router Firmware 9.1.103 - Remote Code Execution RCE Authenticated POC Exploit...

CVE-2025-61882

Oracle E-Business Suite RCE 扫描器 CVE-2025-61882 一个快速、多线程的批量扫描器，用于检测 Oracle E-Business Suite 安装中的 CVE-2025-61882。该严重漏洞允许未经身份验证的远程代码执行。 🎯 功能特性 批量扫描 - 从文件中处理数百或数千个目标 多线程 - 可配置的并发扫描（默认：20 个线程） 自动检测 - 通过执行 id 命令并解析输出来验证 RCE 实时结果 - 易受攻击的目标会立即写入 vuln-output.txt 随机端口 - 为每个目标使用随机端口（2000-9999）以避免冲突 简洁输出...

CVE-2025-6440

CVE-2025-6440 WooCommerce Designer Pro CVE: CVE-2025-6440 CVSS: 9.8 Critical 📝 Description The WooCommerce Designer Pro plugin for WordPress, widely used especially in themes such as Pricom - Printing Company & Design Services, is vulnerable to arbitrary file uploads due to a lack of proper file...

react-cve-2025-55182-lab

Setup: root@kitploit: git clone https://github.com/alexandre-briongos-wavestone/react-cve-2025-55182-lab root@kitploit: cd react-cve-2025-55182-lab root@kitploit: sudo docker build -t react-rsc-lab . root@kitploit: sudo docker run -p 3000:3000 react-rsc-lab Exploit: root@kitploit: curl --path-as-...

CVE-2019-16113

CVE-2019-16113 This is a python implementaiton PoC for the Bludit Directory Traversal Image File Upload Vulnerability CVE-2019-16113 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg or .png file name, and then this PHP code...