Spring-Web-5xx-Mitigated-version

Spring-Web-5xx-Mitigated-version 개요 이 완화된 버전의 Spring Web 5.x.x은 Sonatype 및 Mend를 사용하는 여러 공급업체가 탐지한 중요한 취약점을 해결하기 위해 특별히 제작되었습니다. CVE-2016-1000027 권고에 따라 식별된 이 취약점은 Spring Framework 4.1.4를 신뢰할 수 없는 데이터의 Java 역직렬화에 사용할 경우 원격 코드 실행RCE 위험을 초래합니다. 권장 해결 방법은 5.x.x 이후 버전으로 업그레이드하는 것이며, 이는 OpenJDK 17 이상을...

CVE-2024-4577

연구 목적으로만 기본 XAMPP용 PoC root@kitploit: curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

Exploit-CVE-2025-24801

CVE-2025-24801 This exploit uses CVE-2025-24801 to get Remote Code Execution RCE via Local File Inclusion LFI at GLPI 10.0.17. Proof of Concept PoC of this CVE with explaination to this vulnerability in GLPI. Observation Some applications expose the /glpi/ endpoint e.g.,...

CVE-2026-9645-ScadaBR-Analysis

CVE-2026-9645 — ScadaBR脆弱性分析 技術的な脆弱性分析と、オープンソースのScadaBR SCADA/HMIプラットフォーム に影響を与えるCVE-2026-9645 に関するCVEブリーフィングです。 概要 CVE-2026-9645 は、ScadaBR における重大な認証済みリモートコード実行の脆弱性です。 作成済みのブリーフィングによると： 深刻度： 重大 CVSS v3.1： 9.9 脆弱性タイプ： 認証済みリモートコード実行 CWE： CWE-78 — OSコマンドインジェクション 影響を受ける製品： ScadaBR 必要なアクセス権：...

POC-CVE-2017-8464-OpenCalculator

CVE-2017-8464 / research + PoC Create 1 Shortcut + 1 .DLL containing malicious payload = Put it on a USB and send to victim = victim opens USB = Payload automatically triggers ! ROOT CAUSE 1. First, we need to know exactly where this bug comes from! It's because of a feature called Plug-and-Play ...

CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC Aloja exploit.html en localhost, puerto 80. Abre el docx para que aparezca la calculadora. Para cambiar la dirección remota a la que apunta el documento, ábrelo en 7Z y edita word\rels\document.xml.rels para que apunte a una nueva ubicación...

CVE-2021-41773m

CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...

Letta-CVE-2025-51482-RCE

Letta-CVE-2025-51482-RCE Vulnerability Cause Analysis 1. Lack of Code Security Inspection Problem: The system does not perform any security inspection on user-provided source code. Evidence: generateexecutionscript method directly inserts user code into the execution script: root@kitploit: code +...

CVE-2023-49070

CVE-2023-49070 Pre-auth RCE in Apache Ofbiz!! Check POC Video: https://youtu.be/gDzYb6YvBSQ...

CVE-2010-1872-BlazeDVD-SEH-Exploit

BlazeDVD 5.0 - '.PLF' Playlist SEH Buffer Overflow Exploit CVE-2010-1872 Proof-of-Concept PoC exploit targeting a buffer overflow vulnerability in BlazeDVD version 5.0 via a crafted .plf playlist file. The exploit uses SEH Structured Exception Handler overwrite to achieve code execution. Details...

rails-PoC-CVE-2016-2098

Una prueba de concepto de la vulnerabilidad: CVE-2016-2098 Proyecto universitario creado por @alejandro-marting donde podemos comprobar la vulnerabilidad 2096 Usando: rails 4.2.5.1 la vista tiene un código vulnerable app/views/poc/render1.html.erb !...

CVE-2023-45866_EXPLOITS

This repository does not have a README...

CVE-2024-29510

Original research and POC code: https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/ NOTE: I have made no changes to the POC apart from the command executed. Full credit goes to Thomas Rinsma @ Codean Labs for their amazing research and POC. Local Scenario 1...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC Descripción sugerida JFinal CMS 5.1.0 está afectado por: Inyección SQL. Estas interfaces no utilizan el mismo componente, ni tienen filtros, sino que cada una utiliza su propio método de concatenación SQL, resultando en inyección SQL. Información adicional...

CVE-2023-43838

CVE-2023-43838 An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar. Additional Information 1. Create alert.svg with the following content: root@kitploit:...

CVE-2020-9484

CVE-2020-9484 참조 작성자: redtimmysec, masahiro331 https://packetstormsecurity.com/files/157924/CVE-2020-9484.tgz + 방금 1-day 익스플로잇을 분석했습니다. 그런 다음 재구성했습니다. 설명 이전 PoC와 비교하면 다음과 같은 장점이 있습니다. + Ubuntu 18.04용 환경 스크립트. + 원격 코드 실행에 사용할 명령어를 편집할 수 있습니다. + 쿠키 값이 PoC 코드에 미리 설정되어 있습니다. 사용법 root@kitploit: id :...

cve-2024-37762

Descripción MachForm hasta la versión 21 se ve afectado por una carga de archivos sin restricciones autenticada que conduce a una ejecución remota de código. La aplicación ofrece la posibilidad de crear un formulario con funcionalidad de carga de archivos. Aunque por defecto los archivos aceptado...

CVE-2015-8351

gwollebuster this script is exploit for wordpress old plugin gwolle usage: ./gwollebuster.py first arguments = your target url of wordpress that installed gwolle second arguments = your ip third arguments = listening port for reverse shell example: ./gwollebuster.py http://vulnpress.com/...

CVE-2024-52402

🚀 Exploit for CVE-2024-52402: WordPress Exclusive Content Password Protect Plugin -un -p 🛠️ Options...

CVE-2025-24893

CVE-2025-24893 - Ejecución Remota de Código No Autenticada en XWiki Exploit PoC para la vulnerabilidad de Ejecución Remota de Código No Autenticada en XWiki CVE-2025-24893. Este PoC permite ejecutar comandos arbitrarios a través de código Groovy en la macro SolrSearch. Detalles root@kitploit:...