626237 matches found
Confluence_CVE-2021-26084
ConfluenceCVE-2021-26084 Remote Code Execution on Confluence Servers : CVE-2021-26084 PoC Confluence Possible exploit endpoints root@kitploit: https:///login https:///pages/templates2/viewpagetemplate.action https:///template/custom/content-editor https:///templates/editor-preload-container...
PoC-CVE-2019-1003030
Jenkins 2.63 Script Security Sandbox Bypass PoC This project automates the creation and delivery of Groovy payloads to the Jenkins SecureGroovyScript validation endpoint used by Jenkins 2.63. The tool supports both interactive and one-shot execution. the exploit doesn't return output so you are...
CVE-2026-38526-KrayinCRM-RCE
CVE-2026-38526 - Krayin CRM RCE xpl0ited by infrar3d This is a Remote Code Execution RCE proof-of-concept specifically designed for Krayin CRM v2.2.x, an open-source customer relationship management system. The script automates the exploitation of a file upload vulnerability in the CRM's...
CVE-2024-9162
CVE-2024-9162 All-in-One WP Migration and Backup = 7.86 - Authenticated Administrator+ Arbitrary PHP Code Injection The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and...
CVE-2024-24919
Check Point Security Gateway RCE Exploit Tool CVE-2024-24919 Overview This repository contains a tool for exploiting the CVE-2024-24919 vulnerability in Check Point Security Gateways. The tool is a multi-scanner that can identify vulnerable devices and a single-target exploit that can take full...
CVE-2026-27971_POC
CVE-2026-27971 — Qwik server$ Unauthenticated RCE PoC !WARNING This repository contains an active remote-code-execution proof of concept. Use it only against systems you own or are explicitly authorized to test. The author assumes no responsibility for unauthorized use or damage. A standalone...
CVE-2026-59827
CVE-2026-59827 — Unsafe Deserialization of H2 Query Results in Metabase GHSA-w95f-x9v9-wv36 | CVSS 9.9 Critical | CWE-502: Deserialization of Untrusted Data Overview CVE-2026-59827 is a critical remote code execution vulnerability in Metabase, the popular open-source business intelligence and dat...
CVE-2026-23918-Double-free-Apache-httpd-mod_http2
CVE-2026-23918 - Apache httpd modhttp2 PoC This repository contains a proof-of-concept implementation written in Go for a pre-authentication memory corruption scenario affecting Apache httpd with modhttp2. The code in this repository demonstrates a spray-and-trigger approach against a vulnerable...
CVE-2026-41472-POC
CyberPanel XSS to RCE CVE-2026-41472 One-click Remote Code Execution in CyberPanel v2.4.3 via unauthenticated API endpoints. Overview This exploit chains multiple vulnerabilities in CyberPanel's AI Scanner feature: 1. Unauthenticated Database Injection /api/ai-scanner/callback accepts arbitrary...
CVE-2022-29056
CVE-2022-29056 Exploit Automation For Educational Purposes 🚨 📌 Description This is a Python script with a graphical interface Tkinter that allows the user to test automated request submissions to a login endpoint. The goal is to simulate how servers respond to different payload sizes and analyze...
KindaRails2Shell
KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-file proof of concept and loopback-only Docker lab for the Rails Active Storage/libvips arbitrary-file-read vulnerability. It also demonstrates the advisory's conditional escalation from a recovered secretkeybase to a forged image variati...
CVE-2024-0582
GenIoURingExploit es un exploit PoC que apunta a una vulnerabilidad específica en el kernel de Linux CVE-2024-0582. El PoC aprovecha el mecanismo iouring para obtener acceso no deseado y potencialmente escalar privilegios manipulando los búferes de sockets y desencadenando ciertos comportamientos...
CVE-2021-36747
CVE-2021-36747 Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. Discovered: May 11th, 2018 The Blackboard Security Team has been notified of this issue. They acknowledged the vulnerability on May 14, 2018. Description: The Blackboard tool commonly...
fastjson-rce-lab
Fastjson 1.2.83 RCE Lab Environment CVE-2026-16723 Disclaimer: This lab is intended solely for security research, teaching demonstrations, and defense construction in authorized environments. Testing unauthorized targets without permission may be illegal; users bear all responsibility for the...
IngressNightmare-PoC
Exploit for Ingress NGINX - IngressNightmare This project provides an exploit targeting critical unauthenticated Remote Code Execution RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare. Research by Wiz In the original research, the Wi...
CVE-2025-24893-POC
CVE-2025-24893 Install bun: root@kitploit: curl -fsSL https://bun.com/install | bash To install dependencies: root@kitploit: bun install To run: root@kitploit: bun run CVE-2025-24893.ts This project was created using bun init in bun v1.2.19. Bun is a fast all-in-one JavaScript runtime. How to use...
CVE-2020-11932
CVE-2020-11932 Double-Free bug in WhatsApp exploit poc. Note: Make sure to set the listner ip in exploit.c inorder to get shell nc -lvp 1337 or whatever port. and then compile. make or gcc -o exploit egiflib.c exploit.c then run ./exploit and save the content to .gif and send to victim. Source...
CVE-2024-28397-RCE
CVE-2024-28397 RCE Script Default reverse shell payload and optional command argument allowed exploit works for js2py = v0.74 Requirements Python 3.x requests library pip install requests Netcat listener for reverse shell Example usage Reverse shell: root@kitploit: python exploit.py 10.129.227.10...
CVE-2025-53770-Exploit
CVE-2025-53770-Exploit First, get the VIEWSTATEGENERATOR, VALIDATIONKEY, VALIDATIONALG value from the target SharePoint page: root@kitploit: curl -s https://target.com/layouts/15/start.aspx | grep -oP 'VIEWSTATEGENERATOR" value="\K^"+' curl https://target.com/layouts/15/spinstall0.aspx Then, crea...
CVE-2018-17179-OpenEMR
CVE-2018-17179-OpenEMR ⚠️ Disclaimer This repository is intended strictly for educational and research purposes only. The information and code provided here can be used in controlled environments , such as private lab machines. Unauthorized use of this code against systems you do not own or have...