S2-045-EXP-POC-TOOLS

CNVD-ID CNVD-2017-02474 Release Date 2017-03-07 Hazard Level High AV:N/AC:L/Au:N/C:C/I:C/A:C Affected Products Apache Struts =2.3.5, =2.5, CVE Identifier CVE-2017-5638 Problem It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value...

CVE-2025-48384

PoC для CVE-2025-48384 См. CVE-2025-48384 Для запуска: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules [email protected]:liamg/CVE-2025-48384.git Пример вывода: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules CVE-2025-48384 test Cloning...

RemoteKeyStrokes

RemoteKeyStrokes A script to automate keystrokes through an active remote desktop session that assists offensive operators in combination with living off the land techniques. All credits goes to nopernik for making it possible so I took it upon myself to improve it. I wanted something that helps...

CVE-2020-0688-Scanner

CVE-2020-0688-Scanner Quick C tool for checking CVE-2020-0688 on multiple hosts with a non-intrusive method. Features Scan hosts from an input file. Passive check : grab exchange version by scraping html content. Produces an output file. Demo How to use Prerequisite Windows .NET framework 4.5.2...

cve-2020-0688-webshell-upload-technique

Exchange Remote Code Execution cve-2020-0688 - RED TEAM MODE ON require: python3+ UNIVERSAL Python implementation for cve-2020-0688, utilizing ASPX webshell for custom command output This just a POC to facilitate vulnerability demostrations for security reasons. I disapprove every illegal actions...

apache-cve-2021-42013-rce

apache-cve-2021-42013-rce Docker-based penetration testing lab simulating CVE-2021-42013 vulnerability Path Traversal & RCE on Apache HTTP Server 2.4.49. This project is prepared to simulate and exploit the CVE-2021-42013 vulnerability found in Apache HTTP Server 2.4.49 in an isolated environment...

CVE-2013-2729

Adobe Reader BMP/RLE heap corruption - CVE-2013-2729 Adobe Reader X is a powerful software solution developed by Adobe Systems to view, create, manipulate, print and manage files in Portable Document Format PDF. Since version 10 it includes the Protected Mode, a sandbox technology similar to the...

CVE-2026-81766

CVE-2026-81766 affects the Really Simple Security WordPress plugin before 9.8.0 . The vulnerability resides in the rsp_upgrade_install_plugin function, which fails to verify that the requesting user is authorized to install a plugin from a user-supplied URL. On a WordPress multisite network, this...

CVE-2026-19722

WPvivid — Backup, Migration & Staging is a WordPress plugin affected by a Zip Slip vulnerability prior to version 0.9.133 . During backup restoration, the plugin does not validate the destination path of files extracted from a backup package, allowing an authenticated user with high privileges (e...

EUVD-2026-68156

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

EUVD-2026-68160

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

EUVD-2026-68154

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

ddoor

ddoor クロスプラットフォームのバックドア。DNS TXTレコードを使用します。 ddoorとは？ ddorは、TXTレコードを使用して感染したマシン上でコマンドを実行する、クロスプラットフォームの軽量バックドアです。 機能 1つのTXTレコードでLinuxとWindows両方のマシンに対して別々のコマンドを指定可能 約10のパブリックDNSサーバーのリストからランダムに選択 予測不能なコールバック時間 カスタムパスワードによるXOR暗号化でTXTレコードを暗号化 DNS over HTTPSをサポート（Keith @keharvに感謝！） Linuxの機能：...

CVE-2024-21305

CVE-2024-21305 This repo contains the report and PoC of CVE-2024-21305, the non-secure Hypervisor-Protected Code Integrity HVCI configuration vulnerability. This vulnerability allowed arbitrary kernel-mode code execution, effectively bypassing HVCI, within the root partition. For the root cause,...

drinkme

drinkme drinkme est un harnais de test pour shellcode. Il lit le shellcode depuis stdin et l'exécute. Cela permet aux pentesteurs de tester rapidement leurs charges utiles avant le déploiement. Formats drinkme peut gérer le shellcode dans les formats suivants : "0x" "\x" "x" "" Par exemple, NOP...

java-remote-class-loader

Esta herramienta te permite enviar bytecode de Java en forma de archivos de clase a tus clientes o potenciales objetivos para cargarlos y ejecutarlos usando ClassLoader de Java junto con la API Reflect. El cliente recibe el archivo de clase del servidor y devuelve la salida de ejecución...

Joomla! ionFiles 4.4.2 - Local File Inclusion

Joomla! ionFiles 4.4.2 is susceptible to local file inclusion in download.php in the ionFiles comionfiles that allows remote attackers to read arbitrary files via a .. dot dot in the file parameter. id: CVE-2008-6080 info: name: Joomla! ionFiles 4.4.2 - Local File Inclusion author: daffainfo...

FOG Project < 1.5.10.34 - Remote Command Execution

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. id: CVE-2024-39914 info: name: FOG Project 1.5.10.34 - Remote...

WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE

The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...

WordPress wSecure Lite < 2.4 - Remote Code Execution

WordPress wsecure plugin before 2.4 is susceptible to remote code execution via shell metacharacters in the wsecure-config.php publish parameter. id: CVE-2016-10960 info: name: WordPress wSecure Lite 2.4 - Remote Code Execution author: daffainfo severity: high description: WordPress wsecure plugi...