627817 matches found
PoC-CVE-2025-62222
PoC: CVE-2025-62222 - GitHub Copilot Chat RCE This repository contains a Proof of Concept PoC for the vulnerability CVE-2025-62222. It demonstrates how Remote Code Execution RCE can be achieved on a developer's machine by manipulating the context of GitHub Copilot Chat in VS Code via hidden promp...
CVE-2022-22954
CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: root@kitploit: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file |...
CVE-2021-40870
CVE-2021-40870 Aviatrix allows an authenticated user to execute arbitrary code...
CVE-2024-27348-HugeGraph-RCE
CVE-2024-27348: Apache HugeGraph RCE Advanced Sandbox Bypass An advanced, highly reliable Proof of Concept PoC exploit for CVE-2024-27348 Remote Code Execution in Apache HugeGraph Server. Unlike many public PoCs that execute commands blindly or fail on complex payloads due to Java's Runtime.exec...
CVE-2021-22893
CVE-2021-22893 Proof-of-Concept PoC script to exploit Pulse Secure CVE-2021-22893. Usage Achieves RCE on Pulse Secure VPNs root@kitploit: chmod +x exploit.sh ./exploit.sh 10.0.0.1 ./exploit.sh -l ./exploit.sh -l IPList.txt...
CVE-2021-21972
CVE-2021-21972 CVE-2021-21972 VMware vSphere Client Carga de archivos no autorizada para ejecución remota de código RCE El vSphere Web Client HTML5 es esencialmente una interfaz administrativa que permite la gestión de una instalación de vSphere. El vSphere Client proporciona a un administrador...
CVE-2018-15961
CVE-2018-15961 - Adobe ColdFusion RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2021. Descripción del Exploit El exploit envía una solicitud POST que contiene un reverse shell JSP a /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm...
CVE-2025-59528.yaml
CVE-2025-59528.yaml Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses...
CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection
CVE-2025-67644 PoC – Inyección SQL en LangGraph SQLite Checkpoint CVE-2025-67644 es una vulnerabilidad de inyección SQL CWE-89 en el paquete langgraph-checkpoint-sqlite parte del ecosistema LangGraph / LangChain. Permite a un atacante inyectar SQL arbitrario a través de claves de filtro de...
CVE-2024-42009
CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Overview This repository demonstrates a working Proof-of-Concept PoC for CVE-2024-42009 , a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail. The vulnerability is caused by improper HTML sanitization followed by unsafe attribute...
CVE-2025-55182
Herramienta de detección por lotes CVE-2025-55182 Herramienta eficiente de detección por lotes para la vulnerabilidad de contaminación de prototipos CVE-2025-55182 de Next.js. Introducción a la vulnerabilidad CVE-2025-55182 es una vulnerabilidad de contaminación de prototipos en el framework...
CVE-2025-69516
CVE-2025-69516 - Ejecución remota de código en Tactical RMM Este repositorio contiene un script de Python que automatiza la explotación de la vulnerabilidad SSTI CVE-2025-69516 en Tactical RMM. Ha sido probado en la versión 1.3.1. Uso root@kitploit: python xpl.py -d api.tactical.xyz -t SESSIONTOK...
Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911
Rocket.Chat: Toma de control de cuenta no autenticada automatizada para RCE CVE-2021-22911 Prueba de concepto completa de RCE no autenticado para Rocket.Chat 3.12.1 CVE-2021-22911 El PoC original creado por Enox. Actualmente esto solo funciona para cuentas sin 2FA. Pronto añadiré bypasses de 2FA...
CVE-2022-26809-RCE
CVE-2022-26809-RCE CVE-2022-26809-RCE https://satoshidisk.com/pay/CFGspB...
CVE-2026-72649
This CVE affects the Elasticsearch machine learning component , where a deserialization of untrusted data flaw (CWE-502) via object injection (CAPEC-586) permits remote code execution . A specially crafted trained model artifact can cause attacker-controlled logic to execute with a materially bro...
CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
EUVD-2026-69562
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...
CVE-2026-2898-FunAdmin-Deserialization
CVE-2026-2898 - Deserialización insegura en FunAdmin Resumen FunAdmin Aviso legal Solo con fines educativos y pruebas autorizadas...
CVE-Requests-1896609
CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Executive Summary This report details two critical security vulnerabilities discovered in the feiskyer/mcp-kubernetes-server package. When deployed, the server exposes an MCP tool named kubectl which is intended to provide limited, safe access...