CVE-2017-3506

What is this? This is a poc of CVE-2017-3506Weblogic XMLDecoder Serialization How to use it? check vul root@kitploit: java -jar WebLogic-XMLDecoder.jar -u http://192.168.174.144:7001 GetShell root@kitploit: java -jar WebLogic-XMLDecoder.jar -s http://192.168.174.144:7001...

CVE-2021-41773

CVE-2021-41773 This is my first time trying to make an exploit for something so...be nice 😁 root@kitploit: Exploit Title: Apache HTTP Server 2.4.49 Path Traversal Author: 0xRar , 0xrar.net CVE: CVE-2021-41773 Version: Apache 2.4.49 Not Tested Yet Help Command: root@kitploit: python3 exploit.py -h...

CVE-2020-0796-BOF

This is Raphael's tinkering around with the SMBGhost LPE. I started with the source code from the Metasploit Framework: cve-2020-0796: SMBv3 Compression Buffer Overflow SMBGhost CVE 2020-0796 https://github.com/rapid7/metasploit-framework/tree/master/external/source/exploits/CVE-2020-0796 BSD...

CVE-2023-20198

CVE-2023-20198 Exploit PoC for CVE-2023-20198 Description CVE-2023-20198 is characterized by improper path validation to bypass Nginx filtering to reach the webuiwsmahttp web endpoint without requiring authentication. By bypassing authentication to the endpoint, an attacker can execute arbitrary...

CVE-2026-52806

Gogs RCE — Argument Injection in git rebase CWE-88 Authenticated remote code execution against Gogs is parsed by Git as the --exec flag rather than a positional argument, causing sh -c to run after each replayed commit during the rebase. How the exploit works 1. Pre-flight — determines if the...

CVE-2026-18963-Exploit

CVE-2026-18963 — Keycloak reset-credentials bypass → unauthenticated account takeover Knowing only a username or e-mail address , an unauthenticated attacker sets an arbitrary password on any Keycloak account. The password-reset e-mail is delivered to the real victim and is never needed — the...

CVE-2025-2005

WordPress FEUP Arbitrary File Upload Exploit CVE-2025-2005 This repository provides a Proof of Concept PoC exploit for the WordPress Front End Users plugin versions up to 3.2.32, which is vulnerable to arbitrary file upload due to missing MIME/file-type validation in its registration form.This...

winmagic_sd

Technical Write-up on CVE-2020-11519 and CVE-2020-11520 Date: June 2020 Author: Dennis Elser code: github Table of Contents Introduction Approach and Technical Description CVE-2020-11519 CVE-2020-11520 Proof-of-Concept Exploit Disclosure Timeline Solution Checksums References Introduction In...

CVE-2020-35729

Information root@kitploit: Exploit Title: Klog Server 2.4.1 - Command Injection Unauthenticated Date: 22.12.2020 Exploit Author: b3kc4t Mustafa GUNDOGDU Vendor Homepage: https://www.klogserver.com/ Version: 2.4.1 Tested On: Ubuntu 18.04 CVE: 2020-35729 Description:...

masq

Sit where the model sits. See what it can see. MASQ MASQ is a local security CLI for AI agent stacks. It sits in the same seat the model sits in: it reads MCP tool catalogs, completes the MCP handshake, looks through session logs, and probes local model HTTP ports. Then it prints findings and...

evil-rmi-server

evil-rmi-server An evil RMI server that can launch an arbitrary command. May be useful for CVE-2021-44228 in a local privesc scenario Build ./gradlew bootJar Run root@kitploit: Usage: java -jar build/libs/evilRMIServer-1.0-SNAPSHOT.jar -hV -p= An evil RMI Server to help construct and run an...

CVE-2026-57239

Foxit PDF Reader LPE Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxit PDF Reader updater service. Build Just build the binary, drop it on your target and run it. root@kitploit: cargo build --release Usage Th...

Open-Source-Threat-Intel-Feeds

Free Threat Intel/IOC Feeds This repository contains Open Source freely usable Threat Intel feeds that can be used without additional requirements. The CSV ThreatIntelFeeds is stored in a structured manner based on the Vendor, Description, Category and URL. The vendors offering ThreatIntelFeeds a...

CVE-2026-13768

CVE-2026-13768: Privileged IoT Hub Credential — Fleet Enumeration, Device RCE, and Home-Network Pivot Advisory Field| Value ---|--- CVE| CVE-2026-13768 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 10.0 Critical Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L Vector 4.0|...

CVE-2019-10999

D-Link Exploit The exploit exists in the devices server, alphapd, when processing wireless.htm prior to displaying it to the user. If WEPEncryption is provided in the URL this leads to a buffer overflow if the value is longer than 0x28 bytes. A URL of the form: root@kitploit:...

CVE-2022-1388

Vuln Impact This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. Vuln Product F5 BIG-IQ 11.6.1 - 11.6.5 F5 BIG-IP...

CVE-2026-49176_LPE_POC

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. Technical write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM. A standard user creates a Wallet ESE database containing a persisted callbac...

cve-2019-17558-apache-solr-rce

Apache Solr RCE CVE-2019-17558 - CTF Write-up Practical exploitation of a Velocity Template Injection vulnerability in Apache Solr, progressing from a failure in an automated tool Metasploit to a successful manual exploitation. This write-up documents the complete reasoning of the exercise,...

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge...

CVE-2026-40453

Case-Variant Camel Header Injection Reproducer CVE-2026-40453 This project demonstrates CVE-2026-40453 — an incomplete fix for CVE-2025-27636. The 2025 fix added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names e.g. CAmelExecCommandExecutable are filtered alongside t...