CVE-2021-22204

Vulnerable Version 7.44 12.23 Reproduce root@kitploit: $ bash craftadjvuexploit.sh 'cal' $ ./exiftool delicate.jpg Screenshot Reference NVD-CVE-2021-22204...

CVE-2026-80672

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability arises from an integer truncation error when validating the size of the $LogFile restart area and its log client record array. An attacker can exploit this by mounting a specially crafted NTFS image, leading to an...

CVE-2026-82877

ILIAS eLearning versions before 9.22, 10.0–10.9, and 11.0–11.2 are affected by an arbitrary file read vulnerability in the SOAP addFile method. The root cause is that crafted XML with COPY-mode imports allows an unsandboxed import directory to be abused into constructing absolute file paths. Auth...

5MMISSI-CVE-2017-1000499

5MMISSI-CVE-2017-1000499 PoC of CVE-2017-1000499 phpMyAdmin versions 4.7.x prior to 4.7.6.1/4.7.7 are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc...

CVE-2017-7529

CVE-2017-7529 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. Installation $ git clone...

CVE-2022-44268-pilgrimage

CVE-2022-44268 Arbitrary File Read PoC - PNG generator This is a proof of concept of the ImageMagick bug discovered by https://www.metabaseq.com/imagemagick-zero-days/ This is an automated tool for Pilgrimage HackTheBox challenge. This is a fork from https://git.rotfl.io/v/CVE-2022-44268. Tested ...

CVE-2026-65315

A flaw was found in Ollama. A remote attacker can exploit an uncontrolled memory allocation vulnerability in the GGUF metadata parser. By supplying a specially crafted GGUF file, an attacker can manipulate length and count fields, leading to excessive memory allocation. This can cause the server ...

CVE-2025-24071_PoC

CVE-2025-24071 / CVE-2025-24054 PoC Edit: MICROSOFT HAS BEEN RENAMED CVE-2025-24071 AS CVE-2025-24054 🤔 Overview This Windows vulnerability, specifically in 'explorer.exe', allows us to receive a NetNTLMv2 hash from a victim simply by having the attacker extract a .zip file. Usage Execute the...

CVE-2026-71514

A flaw was found in NLTK. This path traversal vulnerability in the CrubadanCorpusReader component allows an attacker, who controls a corpus package, to disclose file contents outside the intended corpus directory. This occurs because a specially crafted input can bypass security checks, leading t...

CVE-2018-10546

CVE-2018-10546 Пользователь может создать специально сформированные данные, которые при обработке с использованием потокового фильтра 'convert.iconv.' приведут к тому, что целевое приложение войдет в бесконечный цикл и будет потреблять избыточные ресурсы ЦП CVE-2018-10546. Конкретное влияние этих...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

CVE-2007-2447-Exploit

CVE-2007-2447 Exploit This repository contains an exploit for Samba smbd 3.0.20 CVE-2007-2447 that allows remote command execution via crafted SMB requests. Prerequisites This exploit requires Python 3 and a few dependencies. It's recommended to set up a virtual environment before running the...

CVE-2026-11645

CVE-2026-11645 - V8 in Google Chrome prior to Remote Code Execution Quick Usage root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-06-09...

CVE-2017-5638

CVE-2017-5638 Table of Contents 1. Overview 2. Dependencies 3. Usage Overview This project is a prove-of-concept for the Apache Struts vulnerabilty. The goal was to create software that can generate and test random IPs for the vulnerabilty described above. Use this project on your own risk and fo...

CVE-2026-80599

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module. An attacker, by sending specially crafted network packets, could trigger an out-of-bounds memory access in the batadvgetvid function. This occurs because the function fails to verify t...

CVE-2025-6218-WinRAR-Directory-Traversal-RCE

CVE-2025-6218-WinRAR-Directory-Traversal-RCE CVE-2025-6218 is a directory traversal vulnerability in WinRAR that allows an attacker to place files outside the intended extraction directory when a user extracts a specially crafted .rar archive. By exploiting this flaw, an attacker can drop malicio...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...

CVE-2025-64512

CVE-2025-64512 — 通过构造的PDF实现pdfminer.six不安全的反序列化（Pickle） ⚠️ 免责声明： 此工具仅供教育目的和授权的渗透测试使用。仅用于您拥有或获得明确书面许可的系统。未经授权使用是非法的。 目录 概述 漏洞详情 工作原理 要求 安装 使用方法 示例 缓解措施 致谢 参考 概述 pdfminer.six...

Microsoft-Edge-Information-Disclosure

Microsoft-Edge-Information-Disclosure CVE-2024-30056 Microsoft Edge Chromium-based Information Disclosure Vulnerability This is a vulnerability in Microsoft Edge Chromium-based. The attacker was able to trick the user into revealing sensitive information without his knowledge. Poc: root@kitploit:...

CVE-2020-28415

CVE-2020-28415 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414. Vulnerability Type Cross Site...