CVE-2024-46658

CVE-2024-46658 Syrotech SY-GOPON-8OLT-L3 v1.6.0240629 Command Injection Vulnerability Usage 1- Edit the URL in the script. 2- Edit the CookieLogin value in the script. 3- Run the script, it will allow you to executing commands. Vulnerability Details GET...

Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

Microfinance Management System V1.0 SQL Injection Vulnerability Unauthenticated 1. Description: Microfinance Management System allows SQL Injection via parameter 'customernumber' in /mims/updatecustomer.php. Exploiting this issue could allow an attacker to compromise the application, access or...

CVE-2025-47827

CVE-2025-47827 Proof-of-concept and vulnerability report for CVE-2025-47827. Contents Description Disclosure Impact Detection Mitigation Binaries Proof of Concept Resources Description In IGEL OS before v11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a...

CVE-2025-4524

CVE-2025-4524 - Unauthenticated madara-core Wordpress theme LFI WordFence link Description A vulnerability lies in madara's madaraloadmore action, where a template parameter is arbitrary data from the user and passed to PHP's include function. Vulnerability A vulnerability lies in madara's...

CVE-2024-32113

CVE-2024-32113 Apache OFBIZ Batch Scanning 注意：このツールを違法攻撃に使用することを支援するものではありません。このツールは技術的な交流のみを目的としています。 Note: This tool does not support any illegal attacks. It is intended solely for technical exchange. 注意：本人不支持任何人使用本工具进行非法攻击，本工具仅作为技术交流。 Help root@kitploit: CVE-2024-32113 Batch Scanning optional...

wardn

wardn A credential firewall for AI agents. The headline claim is structural, not policy: agents receive placeholder tokens, never real API keys. The real key crosses only one network seam — inside the wardn proxy, on its way to the upstream API — and is stripped from responses before they reach t...

blogpost_cve-2018-19987-analysis

CVE-2018-19987 D-Link OS command injection analysis Hello there! In this short blog post I'll break down a quick analysis that I performed to better understand the details behind CVE-2018-19987. At the beginning I went after this CVE because I thought that there wasn't any public information or...

p3-loader

P³-Shellcode Loader - Process Parameter Poisoning Authors: Max Hirschberger & Ogulcan Ugur Contents 1. Introduction 2. Typical Process Injection and Involved System APIs 3. Technical Foundation of Required Windows Internals 3.1 Process Creation API and Startup Parameters 3.2 The Process Environme...

rwsploit

Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...

CVE-2026-8206

CVE-2026-8206 - Kirki WordPress Plugin Mass Exploit Mass exploitation tool for CVE-2026-8206 – a critical vulnerability in the Kirki WordPress plugin versions ≤ 6.0.6 that allows unauthenticated attackers to hijack password reset links and take over any user account, including administrators...

CVE-2020-29134

Totvs Fluig Platform root@kitploit: Fluig is the productivity and collaboration platform that integrates with the ERP system, and your company's other systems to revolutionize the way you and your team work. CVE-2020-29134 root@kitploit: The TOTVS Fluig platform allows path traversal via paramete...

CVE-2020-35476

CVE-2020-35476 A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. Not finished and doesn't work. Most of the code is there but payload has to be fixed...

reproxy

Reproxy is a simple edge HTTPs server / reverse proxy supporting various providers docker, static, file, consul catalog. One or more providers supply information about the requested server, requested URL, destination URL, and health check URL. It is distributed as a single binary or as a docker...

CVE-2022-22965-Spring4Shell-Security-Operations-Analysis

CVE-2022-22965 — Spring4Shell Security Operations Analysis A hands-on Security Operations Centre SOC simulation where I performed the role of an Information Security Analyst responding to an active Spring4Shell exploitation attempt. This repository documents the full incident response lifecycle —...

CVE-2025-56771

Description During analysis of the ecodotempo.com.br website, a Stored Cross-Site Scripting XSS vulnerability was discovered. This vulnerability allows an attacker to inject malicious scripts into fields that are subsequently rendered to other users without proper sanitization, specifically on th...

CVE-2024-3121

CVE-2024-3121 - Remote Code Execution RCE in parisneo/lollms Discovered by: Syed Jan Muhammad Zaidi GitHub: dark-ninja10 CVE ID: CVE-2024-3121 Repository Affected: parisneo/lollms 🧨 Vulnerability Summary A Remote Code Execution RCE vulnerability exists in the createcondaenv function of the lollms...

CVE-2026-7229-SQLI

Authenticated SQL Injection in Coaching Management System Allows Database Dump Description A SQL Injection vulnerability exists in the Coaching Management System in PHP. The complaintreply parameter in the admin reply functionality is not properly sanitized before being used in SQL queries. An...

PyShell

PyShell PyShell is Multiplatform Python WebShell. This tool helps you to obtain a shell-like interface on a web server to be remotely accessed. Unlike other webshells, the main goal of the tool is to use as little code as possible on the server side, regardless of the language used or the operati...

CVE-2023-33817---SQL-Injection-found-in-HotelDruid-3.0.5

CVE-2023-33817 - SQL Injection found in HotelDruid V3.0.5 HotelDruid v3.0.5 are vulnerable to SQL injection. An attacker could issue arbitrary sql command to retrieve data in databases or even execute remote code execution on target database system This is my second repo. Don't beat me if i didn'...

CVE-2025-1974-poc

POC of IngressNightmare, RCE in Ingress NGINX CVE-2025-1974 Developed from: https://github.com/zwxxb/CVE-2025-1974/blob/main/poc.py https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilitieshow-did-we-discover-ingressnightmare-24 Thanks Usage root@kitploit: forward the admission webhook...