CVE-2019-11447

CVE-2019-11447 - PoC Exploits CuteNews 2.1.2 via poor file upload checks used when uploading an avatar image leading to RCE. Installation Clone the repository and install the requirements. pip install -r requirements.txt Usage In order to upload an avatar you will require a CuteNews user account,...

CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

CVE-2023-46604

CVE-2023-46604 Exploit para CVE-2023-46604 Esta herramienta ayuda a explotar esta vulnerabilidad. Consulta de Shodan para encontrar el objetivo: root@kitploit: product:"ActiveMQ" port:"61616" Uso de la herramienta: root@kitploit: for read targets from the file: python3 exploit.py -f targets -c...

httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc

A flaw was found in Apache HTTP Server, specifically within the modxml2enc module. This heap-based buffer overflow vulnerability can be triggered when processing untrusted content through the xml2StartParse function. A remote attacker could potentially exploit this to cause a denial of service,...

Important: Red Hat Security Advisory: httpd security update

An update for httpd is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass

A vulnerability has been identified in the Apache HTTP Server. If the server is configured to connect to a malicious or compromised backend server, an attacker could exploit this flaw to bypass security controls or run unauthorized code on the system...

Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow

A flaw was found in modproxyajp of Apache HTTP Server. This heap-based buffer overflow vulnerability allows a remote attacker, by connecting to a malicious AJP Apache JServ Protocol server, to send a specially crafted message. This message can cause modproxyajp to write attacker-controlled data...

httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration

A flaw was found in Apache HTTP Server when using the modldap module in a per-directory configuration. This use-after-free vulnerability allows a remote attacker to potentially execute arbitrary code or cause a denial of service DoS due to improper memory handling. This could lead to system...

CVE-2020-14295

CVE-2020-14295 CVE-2020-14295 prueba de concepto. La publicación original se puede encontrar en exploit-db. Instalar requisitos root@kitploit: python3 -m pip install -r requirements.txt Uso root@kitploit: $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti...

CVE-2025-24813-Exploit

CVE-2025-24813-Exploit Exploit de ejecución remota de código RCE en Apache Tomcat - CVE-2025-24813 🚀 Exploit de RCE en Apache Tomcat - CVE-2025-24813 🔥 Herramienta de Exploit y Detección para Apache Tomcat RCE CVE-2025-24813 Este repositorio contiene un exploit PoC Prueba de Concepto para la...

CVE-2014-6271

CVE-2014-6271 A vulnerability known as "ShellShock" exists in GNU Bash through 4.3 due to how it processes trailing strings in the values of environment variables after function definitions. This vulnerability enables remote attackers to execute arbitrary code by crafting the environment in certa...

CVE-2017-5638

CVE-2017-5638 Las versiones de Apache Struts 2 2.3.x anteriores a 2.3.32 y 2.5.x anteriores a 2.5.10.1 tienen una falla en su analizador Jakarta Multipart. Esta falla provoca un manejo incorrecto de excepciones y la generación de mensajes de error al intentar cargar archivos. Como resultado, los...

CVE-2023-3519

CVE-2023-3519 Because you can run powershell on ur mum's PC without having to install NMAP or PYTHON or tell anyone you run ARCH! ; x...

CVE-2023-23924

CVE-2023-23924 Dompdf vulnerable a fallo de validación de URI en el análisis de SVG · CVE-2023-23924 · GitHub Advisory Database https://github.com/advisories/GHSA-3cw5-7cxw-v5qg Ejecución root@kitploit: Terminal 1 ❯ cd www ❯ php -S 127.0.0.1:9000 -t . Terminal 2 ❯ cd src ❯ php cve202323924.php...

CVE-2024-35333

CVE-2024-35333 Existe una vulnerabilidad de desbordamiento de búfer en la pila en la funcionalidad de manejo de charset de html2xhtml versión 1.3. Un atacante puede explotar esta vulnerabilidad proporcionando una entrada especialmente diseñada, lo que provocaría el desbordamiento de la variable...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Introduction In the ever-evolving landscape of cybersecurity, web applications remain a prime target for attackers seeking to exploit vulnerabilities. Recently, two critical vulnerabilities were discovered in the SourceCodester Simple Customer Relationship...

cve-2020-5902

Script de NMAP para la vulnerabilidad RCE "TMUI" de F5 BIG-IP Referer:https://raw.githubusercontent.com/RootUp/PersonalStuff/master/http-vuln-cve2020-5902.nse...

CVE-2024-3400

CVE-2024-3400 root@kitploit: import os,base64,time systempth = "/usr/lib/python3.6/site-packages/system.pth" with opensystempth,'wb' as f: f.writeb'''import...

CVE-2017-1000486

CVE-2017-1000486 Explotación de prueba de concepto para la inyección EL de PrimeFaces 5.x CVE-2017-1000486, una vulnerabilidad RCE que puede usarse para obtener ejecución remota de código en un objetivo. Descripción de la vulnerabilidad Puede encontrar una excelente descripción de la vulnerabilid...

Log4Shell

Log4Shell CVE-2021-44228 ☠️ Log4Shell PoC CVE-2021-44228 Exploit de prueba para la vulnerabilidad crítica Log4Shell en Apache Log4j ≤ 2.14.1, que permite ejecución remota de código mediante inyecciones JNDI. ⚠️ Este PoC es solo para fines educativos y pruebas controladas en entornos autorizados. No...