Exploit_CVE-2026-3854

ExploitCVE-2026-3854 CVE-2026-3854 is a Remote Code Execution in GitHub.com and GitHub Enterprise Server The vulnerability could be exploited by injecting commands into the git push command as follows : root@kitploit: git push -o '' origin master To review any exploitation of this vulnerability, ...

L4sh

Exploit RCE Log4Shell Exploit totalmente independiente que no requiere binarios de terceros. El exploit distribuye el payload a todos los encabezados HTTP registrados posibles, como X-Forwarding , Server-IP , User-Agent Uso root@kitploit: python main.py -i lhost -u http://target:targetport -c...

gxv3175-remote-code-exec

Ejecución remota de código para el teléfono VoIP Grandstream GXV3175. === INSTALACIÓN === copia los archivos a la misma estructura de directorios bajo el directorio de nivel superior de metasploit === USO === en msfconsole use exploits/linux/http/grandstreamgxv3175cmdexec set RHOST 192.168.0.1 se...

tinyfilemanager-2.4.3-exploit

CVE-2021-45010 Exploit de Tiny File Manager-2.4.3 Una vulnerabilidad de path traversal en la funcionalidad de carga de archivos en tinyfilemanager.php del Tiny File Manager del proyecto Tiny File Manager = 2.4.6 permite a atacantes remotos con cuentas de usuario válidas cargar archivos PHP...

php-8.1.0-dev-backdoor-rce

PHP 8.1.0-dev Backdoor Remote Code Execution PHP 8.1.0-dev Backdoor System Shell Script PHP verion 8.1.0-dev was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

EUVD-2026-81074

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92816

ComfyUI versions before 0.30.0 contain a path traversal vulnerability in dataset save nodes (comfy_extras/nodes_dataset.py). The folder_name input is not properly sanitized, allowing an attacker to write files to arbitrary paths outside the intended output directory. By loading a crafted workflow...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92784

@refinedev/inferencer through version 7.0.0 (part of the refine framework) is vulnerable to code injection via API field names . The root cause is a failure to escape API field names when interpolating them into generated JSX source code . An attacker controlling the data provider can inject mali...

Exploits

Este repositorio contiene una colección personal de CVE de Windows que he convertido en código de exploit, así como una colección de payloads que he escrito para usarse junto con estos exploits. Algunos de estos CVE se han combinado en cadenas de exploits para RCE, escapes de sandbox y escalada d...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762 Pelican Panel before 1.0.0-beta35 Authorization Bypass via Startup

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

CVE-2026-92762

Pelican Panel versions before 1.0.0-beta35 contain an authorization bypass in the Startup page component. Write permissions are enforced only through disabled form controls (client-side) rather than server-side checks, meaning an attacker with the low-level startup.read permission can craft Livew...

EUVD-2026-81030

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands,...

EUVD-2026-81020

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution

Cisco-UCS-Manager-2.2-1d-Remote-Command-Execution - Bug de Cisco: CSCur90888 Título del Exploit : Cisco UCS Manager - 2.21d - Ejecución Remota de Comandos Descripción : Un script CGI no especificado en Cisco FX-OS anterior a 1.1.2 en dispositivos Firepower 9000 y Cisco Unified Computing System UC...

CVE-2026-41089-Netlogon-RCE

🛡️ CVE-2026-41089-Netlogon-RCE - Analice vulnerabilidades críticas de servicios de Windows Este repositorio proporciona herramientas para analizar y probar la vulnerabilidad de Netlogon conocida como CVE-2026-41089. Esta herramienta ayuda a los profesionales de seguridad a identificar si sus...

CVE-2026-32746

CVE-2026-32746 - telnetd LINEMODE SLC Buffer Overflow Pre-authentication remote code execution via buffer overflow in GNU InetUtils telnetd's LINEMODE SLC Set Local Characters handler. CVSS 3.1: 9.8 Critical | CWE: CWE-120, CWE-787 Overview The addslc function in telnetd/slc.c appends 3 bytes per...

CentOS-Control-Web-Panel-CVE

CentOS Control Web Panel versión 0.9.8.836 - 0.9.8.847 El 29 de junio de 2019, nuestro equipo comenzó a buscar vulnerabilidades en CentOS Control Web Panel CWP versión 0.9.8.836 y encontramos algunas vulnerabilidades críticas. Algunas de las vulnerabilidades que encontramos pueden encadenarse par...