Lucene search
+L

1859 matches found

Kitploit
Kitploit
•added 2026/09/28 1:06 p.m.•24 views

hacker-scripts

English | 简体中文 Hacker Scripts Based on a true story : xxx: OK, so, our build engineer has left for another company. The dude was literally living inside the terminal. You know, that type of a guy who loves Vim, creates diagrams in Dot and writes wiki-posts in Markdown... If something - anything -...

5.8AI score
SaveExploits0References4
Kitploit
Kitploit
•added 2026/09/28 10:46 a.m.•11 views

CVE-2025-57819-FreePBX-RCE2Root

CVE-2025-57819 — FreePBX SQLi → RCE → Root Full-chain PoC for CVE-2025-57819. Unauthenticated error-based SQL injection in FreePBX's endpoint module chains into a root shell via cron job injection and incron privilege escalation. For authorized testing and research only. Do not use against system...

10CVSS8.9AI score0.85463EPSS
SaveExploits30References2
Kitploit
Kitploit
•added 2026/09/28 7:42 a.m.•11 views

CVE-2022-39952

CVE-2022-39952 POC for CVE-2022-39952 affecting Fortinet FortiNAC The default configuration of this exploit writes a cron job to create a reverse shell. Be sure to change the payload file to suite your environment. Technical Analysis A technical root cause analysis of the vulnerability and...

9.8CVSS8.4AI score0.99794EPSS
SaveExploits7
Kitploit
Kitploit
•added 2026/09/28 3:52 a.m.•10 views

CVE-2025-57819-POC

CVE-2025-57819 — FreePBX SQL Injection → RCE PoC CVE-2025-57819 is a critical SQL injection vulnerability in FreePBX that allows an unauthenticated attacker to achieve remote code execution by chaining a SQL injection with cron job injection. āš ļø Disclaimer : This repository is for authorized...

10CVSS9.1AI score0.85463EPSS
SaveExploits30
Kitploit
Kitploit
•added 2026/09/28 1:09 a.m.•10 views

dawgmon

dawgmon - Dawg the Hallway Monitor SUMMARY The name of this tool is based upon an episode season 10, episode 10 of South Park in which Cartman is Dawg the Hallway Monitor patrolling the hallways of his school. It's a tool which helps one to monitor changes which have taken place on a Linux-based...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
•added 2026/09/27 10:06 p.m.•13 views

CVE-2024-24386

VitalPBX - CVE-2024-24386 Vulnerability Title: Command Injection Author: Erick Duarte Version: 3.2.5-2 The vulnerability occurs when using the Task Manager module in conjunction with Cron Profile. To exploit this vulnerability, we need to place a script in a specific folder within the OS. The...

6AI score0.01024EPSS
SaveExploits1
Kitploit
Kitploit
•added 2026/09/27 8:56 p.m.•54 views

jsmon

JSMon JSMon - JavaScript Change Monitor for BugBounty Using this script, you can configure a number of JavaScript files on websites that you want to monitor. Everytime you run this script, these files will be fetched and compared to the previously fetched version. If they have changed, you will b...

5.7AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/27 1:07 p.m.•10 views

FreePBX-SQLi-Exploit-Privilege-escalation

FreePBX: From Unauthenticated SQL Injection to Root Shell CVE-2025-57819 • FreePBX 16.0.40.7 • HTB Connected šŸ“‹ Executive Summary This walkthrough documents the complete compromise of the HTB machine Connected. The attack chain begins with an unauthenticated SQL injection vulnerability in FreePBX,...

10CVSS9.1AI score0.85463EPSS
SaveExploits30
NVD
NVD
•added 2026/09/26 2:16 p.m.•10 views

CVE-2026-100714

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

9.4CVSS0.00549EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/26 2:16 p.m.•11 views

CVE-2026-100715

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

9.6CVSS0.00399EPSS
SaveExploits0References2
Kitploit
Kitploit
•added 2026/09/26 2:10 p.m.•11 views

CVE-2021-32157

..| XSS to RCE CRON|.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Remote Command Execution RCE through the Webmin's Scheduled Cron Jobs feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Remote Command Execution...

9.6CVSS8.4AI score0.04036EPSS
SaveExploits2
CVE
CVE
•added 2026/09/26 1:24 p.m.•13 views

CVE-2026-100715

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion due to a symlink following flaw in the FTP data deletion cron task (deleteFtpData ). The vulnerability occurs because the FileDir::makeCorrectDir() function is called without the $fixed_homedir argument, causing the symlink...

9.6CVSS5.9AI score0.00399EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/26 1:24 p.m.•10 views

CVE-2026-100715 Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

8.5CVSS5.9AI score
SaveExploits0References4
OSV
OSV
•added 2026/09/26 1:24 p.m.•10 views

CVE-2026-100714 Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...

9.4CVSS5.9AI score
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/26 1:24 p.m.•36 views

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

7.8CVSS0.00156EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/26 1:24 p.m.•8 views

CVE-2026-100713 Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Froxlor 2.3.10 and earlier contain a time-of-check time-of-use TOCTOU race condition in the SSH key synchronization cron lib/Froxlor/Cron/System/SshKeys.php, SshKeys::generateFiles. The containment/symlink validation performed by FileDir::makeCorrectDir/makeCorrectFile is done only at check time;...

7.1CVSS5.8AI score
SaveExploits0References4
Kitploit
Kitploit
•added 2026/09/26 10:57 a.m.•11 views

CVE-2021-32156

..| CSRF to RCE CRON |.. Description : Exploiting a Cross-site request forgery CSRF attack to get a Remote Command Execution RCE through the Webmin's Scheduled Cron Jobs feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Remote Command Execution...

8.8CVSS8.1AI score0.02309EPSS
SaveExploits1
Kitploit
Kitploit
•added 2026/09/26 10:06 a.m.•7 views

jmrozanec__cron-utils_CVE-2021-41269_9-1-5

cron-utils We define crons. And support them. cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. The project follows the Semantic Versioning Convention, provides OSGi metadata and uses Apache 2.0 license. Download cron-utils...

10CVSS7.3AI score0.04349EPSS
SaveExploits1
NVD
NVD
•added 2026/09/26 3:17 a.m.•10 views

CVE-2026-100578

OpenClaw npm package openclaw before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn...

7.6CVSS0.00228EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/26 3:17 a.m.•11 views

CVE-2026-100580

OpenClaw npm package 'openclaw' before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a...

8.8CVSS0.00343EPSS
SaveExploits0References2
Rows per page
Query Builder