CVE-2021-42013

CVE-2021-42013 Contributor 석은호@eunho87 CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability Summary A bug in the path normalization handling of Apache HTTP Server 2.4.50 allows arbitrary file reading or remote code execution without authentication. This occurs due to an incomplete patch...

CVE-2025-55182

CVE-2025-55182 React2Shell Exploit PoC ⚠️ WARNING: This project intentionally uses vulnerable software for security research purposes only. Credits All credits for the PoC go to @maple3142 Setup & Running Docker root@kitploit: docker-compose up --build The app will be available at...

graylog-cve-2024-24824-exploit

Exploiting Arbitrary Class Loading on the JVM This repository contains the proof-of-concept exploit presented in my talk: Exploiting Arbitrary Class Loading on the JVM Watch it here if you're interested: Youtube The exploit targets CVE-2024-24824 minor typo in the slides, an arbitrary class loadi...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...

cve-2020-0796

CVE-2020-0796 is caused by an error in the SMBv3 protocol when processing malicious compressed packets; when decompressing packets using the length passed from the client, the length is not checked for validity, ultimately leading to integer overflow. It allows a remote, unauthenticated attacker ...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated RCE PoC Disclaimer This repository was created for security research and educational purposes only. Use it only in an isolated lab environment. Using it against unauthorized systems is a violation of the Information and Communications Network Act and is...

CVE-2026-21877

CVE-2026-21877 Lab Environment for CVE-2026-1357 1. Build the environment sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo sudo chmod +x networkmonitor.py sudo docker compose up --build -d Firefox : http://localhost:5678 For test...

CVE-2023-4220-Proof-of-concept

CVE-2023-4220-Proof-of-concept Chamilo LMS Unauthenticated Big Upload File that allows remote code execution CODE IS MADE AND USED FOR HACKTHEBOX CTF PERMX Unauthenticated file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS the php...

CVE-2019-10758

CVE-2019-10758 PoC Setup root@kitploit: docker run -p 27017:27017 -d mongo npm install [email protected] cd nodemodules/mongo-express/ && node app.js cURL exploit root@kitploit: curl 'http://localhost:8081/checkValid' -H 'Authorization: Basic YWRtaW46cGFzcw==' --data...

pocKeycloakCVE-2023-0264

PoC CVE-2023-0264 — frontend OIDC session hijacking Static frontend that runs the OIDC flow authorization code against a Keycloak and exposes the sessionid hijacking hook of the PoC. It is served with nginx on port 5174 for team use. Launching it on the VPS root@kitploit: cd vps/pocCVE0264 docker...

CVE-2014-6271-Shellshock-

Exploiting Shellshock CVE-2014-6271: A Complete, Modern Demonstration Lab Shellshock CVE-2014-6271 is one of the most influential remote code execution vulnerabilities ever discovered. The flaw affects Bash and allows attackers to execute arbitrary commands simply by injecting crafted payloads in...

CVE-2025-49132-PHP-PEAR

CVE-2025-49132: Pterodactyl Panel Unauthenticated RCE via PHP PEAR Method Table of Contents Overview Vulnerability Details Technical Analysis Exploit Flow Installation Usage Examples Mitigation Disclaimer References Author Overview This repository contains a proof-of-concept PoC exploit for...

CVE-2023-38035-MobileIron-RCE

MobileIron CVE-2023-38035 Exploit README.md Description This bash script automates the process of scanning for vulnerable MobileIron systems that are susceptible to the CVE-2023-38035 exploit. The script performs multiple checks, including checking for required programs, downloading potential...

CVE-2019-19781-CitrixRCE

Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781 References: https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ Bypassing: 1 - Deleted / Modified scripts at: /vpn/../vpns/portal/scripts/ 2 - Forward Slash "/" issues after perl commnad...

cve-2026-54316-lab

CVE-2026-54316 — Claude Code WebFetch HuggingFace exfiltration lab A self-contained, disposable lab that reproduces GHSA-fg94-h982-f3mm / CVE-2026-54316: Claude Code pre-approved huggingface.co as a bare hostname for the WebFetch tool, so any path on that domain — including attacker-controlled...

CVE-2019-2729_creal

CVE-2019-2729 - creal PoC for exploiting CVE-2019-2729 on WebLogic Exploit Usage root@kitploit: python3 creal.py -h usage: creal.py -h -u URL -f F -c CMD -s SH optional arguments: -h, --help show this help message and exit -u URL, --url URL target url -f F, --file F url file -c CMD, --command CMD...

CVE-2026-90491

A weakness has been identified in sanjevirau gsubs up to 1.0.3. Impacted is the function showQuerySuccessPage of the file renderer/index.js of the component Electron. Executing a manipulation of the argument filename can lead to code injection. The attack may be performed from remote. The exploit...

CVE-2015-9331

CVE-2015-9331 POC Vulnerability Description CVE-2015-9331 is an arbitrary file upload vulnerability in the WordPress plugin WP All Import. This vulnerability allows an unauthenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution. Affected Versions...

MySQL-Remote-Root-Code-Execution

MySQL-Remote-Root-Code-Execution Usage root@kitploit: python rcemysql.py -dbuser -dbpass -dbname -dbhost -mycnf...

CVE-2023-43654

CVE-2023-43654 ShellTorch is a chain of 3 Critical Vulnerabilities in PyTorch TorchServe - the default inference server of PyTorch. This is an End-to-End POC for an SSRF vulnerability which leads to Arbitrary Remote Code Execution from the network 1. Run TorchServe 0.8.1 root@kitploit: docker run...