PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE This repository contains a Proof of Concept PoC for the vulnerability CVE-2025-62222. It demonstrates how Remote Code Execution RCE can be achieved on a developer's machine by manipulating the context of GitHub Copilot Chat in VS Code via hidden promp...

CVE-2022-22954

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity Manager RCE via SSTI. CVE-2022-22954 - PoC SSTI Usage: root@kitploit: CVE-2022-22954.py -h -m SETMODE -i IP -c CMD optional arguments: -h, --help show this help message and exit -m SETMODE, --mode SETMODE Available modes: shodan | file |...

CVE-2021-40870

CVE-2021-40870 Aviatrix allows an authenticated user to execute arbitrary code...

CVE-2024-27348-HugeGraph-RCE

CVE-2024-27348: Apache HugeGraph RCE Advanced Sandbox Bypass An advanced, highly reliable Proof of Concept PoC exploit for CVE-2024-27348 Remote Code Execution in Apache HugeGraph Server. Unlike many public PoCs that execute commands blindly or fail on complex payloads due to Java's Runtime.exec...

CVE-2021-22893

CVE-2021-22893 Proof-of-Concept PoC script to exploit Pulse Secure CVE-2021-22893. Usage Achieves RCE on Pulse Secure VPNs root@kitploit: chmod +x exploit.sh ./exploit.sh 10.0.0.1 ./exploit.sh -l ./exploit.sh -l IPList.txt...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 VMware vSphere Client Carga de archivos no autorizada para ejecución remota de código RCE El vSphere Web Client HTML5 es esencialmente una interfaz administrativa que permite la gestión de una instalación de vSphere. El vSphere Client proporciona a un administrador...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2021. Descripción del Exploit El exploit envía una solicitud POST que contiene un reverse shell JSP a /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – Inyección SQL en LangGraph SQLite Checkpoint CVE-2025-67644 es una vulnerabilidad de inyección SQL CWE-89 en el paquete langgraph-checkpoint-sqlite parte del ecosistema LangGraph / LangChain. Permite a un atacante inyectar SQL arbitrario a través de claves de filtro de...

CVE-2024-42009

CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Overview This repository demonstrates a working Proof-of-Concept PoC for CVE-2024-42009 , a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail. The vulnerability is caused by improper HTML sanitization followed by unsafe attribute...

CVE-2025-55182

Herramienta de detección por lotes CVE-2025-55182 Herramienta eficiente de detección por lotes para la vulnerabilidad de contaminación de prototipos CVE-2025-55182 de Next.js. Introducción a la vulnerabilidad CVE-2025-55182 es una vulnerabilidad de contaminación de prototipos en el framework...

CVE-2025-69516

CVE-2025-69516 - Ejecución remota de código en Tactical RMM Este repositorio contiene un script de Python que automatiza la explotación de la vulnerabilidad SSTI CVE-2025-69516 en Tactical RMM. Ha sido probado en la versión 1.3.1. Uso root@kitploit: python xpl.py -d api.tactical.xyz -t SESSIONTOK...

Rocket.Chat-Automated-Account-Takeover-RCE-CVE-2021-22911

Rocket.Chat: Toma de control de cuenta no autenticada automatizada para RCE CVE-2021-22911 Prueba de concepto completa de RCE no autenticado para Rocket.Chat 3.12.1 CVE-2021-22911 El PoC original creado por Enox. Actualmente esto solo funciona para cuentas sin 2FA. Pronto añadiré bypasses de 2FA...

CVE-2022-26809-RCE

CVE-2022-26809-RCE CVE-2022-26809-RCE https://satoshidisk.com/pay/CFGspB...

CVE-2026-72649

This CVE affects the Elasticsearch machine learning component , where a deserialization of untrusted data flaw (CWE-502) via object injection (CAPEC-586) permits remote code execution . A specially crafted trained model artifact can cause attacker-controlled logic to execute with a materially bro...

CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

EUVD-2026-69562

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-2898-FunAdmin-Deserialization

CVE-2026-2898 - Deserialización insegura en FunAdmin Resumen FunAdmin Aviso legal Solo con fines educativos y pruebas autorizadas...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Executive Summary This report details two critical security vulnerabilities discovered in the feiskyer/mcp-kubernetes-server package. When deployed, the server exposes an MCP tool named kubectl which is intended to provide limited, safe access...