CVE-2023-7028

CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulnerability Overview This repository contains an exploit for CVE-2023-7028 , a critical vulnerability in GitLab that allows an attacker to abuse the password reset functionality and take over accounts, including administrator accounts...

cve-2025-29927

CVE-2025-29927 1. go to /api/flag 2. add x-middleware-subrequest: src/middleware:src/middleware:src/middleware:src/middleware:src/middleware as header 3. see response...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Overview CVE-2026-33017 is an unauthenticated Remote Code Execution RCE vulnerability in Langflow versions This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this too...

CVE-2025-3248

CVE-2025-3248 — Langflow AI Remote Code Execution Unauthenticated Author: 0xgh057r3c0n Description This exploit targets a critical unauthenticated RCE vulnerability CVE-2025-3248 in Langflow AI. The vulnerability allows an attacker to execute arbitrary system commands on the target server via the...

CVE-2024-55271

Gym Management System CVE-2024-55271 A GYM management system built using PHP and MySQL. Auditor Shoaib Alam - LinkedIn Profile Description CSRF Vulnerability in Profile Update Section A Cross-Site Request Forgery CSRF vulnerability has been identified in the Gym Management System. This issue is...

CVE-2026-100502

Flame through version 2.4.0 is vulnerable to an insufficient session expiration vulnerability in its login endpoint. Attackers who possess former administrator access can exploit unvalidated duration parameters to obtain tokens with arbitrary lifespans. Because tokens are verified against a stati...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

poc_salesforce_lightning

PoC for Salesforce lightning Academic purposes Only. This tool dumps the data of Salesforce object through Aura lightning endpoint with the guest privilege. 雑なコードだけど許してくれい Requirement Python3 Usage root@kitploit: $ python3 exploit.py -h usage: exploit.py -h -u URL -o OBJECTS OBJECTS ... -l -c -a...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC & Reproduce This repository contains Proof-of-Concept PoC exploit code and instructions to reproduce the Local File Inclusion LFI vulnerability in MLflow, identified as CVE-2023-1177. Vulnerability Information: CVE ID: CVE-2023-1177 Vulnerability Type: Local File...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX Endpoint Module SQL Injection → Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...

CiscoISE-CVE-2025-20282-POC

Cisco ISE CVE 2025-20282 Proof of concept Writeup: https://riversecurity.eu/like-stealing-cisco-ise-cream-from-a-kid-weaponizing-a-cve/ The python script abuses the upload function that is availible unauthenticated at /admin/files-upload/ The script locally creates a bin folder and a file named...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Pterodactyl Panel RCE Exploit HTB Season 10 - Pterodactyl Machine Writeup Overview Target: Pterodactyl HTB Machine Medium Difficulty CVE: CVE-2025-49132 Severity: Critical CVSS 9.8 Attack Type: Unauthenticated Remote Code Execution Affected: Pterodactyl Panel v1.11.11 This exploi...

CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerable to server-side request forgery Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

CVE-2026-39987_POC

PoC — CVE-2026-39987 · Marimo Pre-Auth RCE CVSS 4.0: 9.3 Critical · AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H Affects: marimo 2 calls to...

jsherp-user-info-idor

jshERP /user/info IDOR — VulDB submission package This repository contains a standalone VulDB-style advisory for an authenticated insecure direct object reference in jshERP. Product: jshERP Tested commit: ad6cf886dd4e0676723060a25d361c703dc56bc0 3.6-SNAPSHOT, GitHub master HEAD on 2026-09-04...

CVE-2026-84460

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization...

CVE-2026-63204

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stored for that run, even if the run...

CVE-2026-49470

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against...

alibi

alibi Cross-check the views of your attack surface and find the endpoints that cannot corroborate each other. An endpoint should be able to account for itself. It is in the code, so a contract should describe it. It is in the contract, so something should implement it. It takes real traffic, so i...

CVE-2026-63204

In Zammad versions prior to 7.1.2 , an authenticated user with agent permissions can exploit a vulnerability in the ticket summarize endpoint . By supplying an arbitrary AI analytics run identifier , an attacker can retrieve the AI provider error message associated with that run. This allows the ...