CVE-2020-8816

CVE-2020-8816 A Python script to exploit CVE-2020-8816, a remote code execution vulnerability on the Pi-hole. This script uses the techniques found by François Renaud-Philippon to achieve remote code execution on a Pi-hole running a web interface version less than 4.3.3. The exploit requires the...

CVE-2025-55182

CVE-2025-55182 A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components. 🚀 Installation root@kitploit: wget -q -O /usr/bin/CVE-2025-55182 https://raw.githubusercontent.com/rix4uni/CVE-2025-55182/refs/heads/main/CVE-2025-55182 && chm...

CVE-2025-64512

CVE-2025-64512 Arbitrary Code Execution in pdfminer.six via Crafted PDF Input PoC based on https://github.com/pdfminer/pdfminer.six/security/advisories/GHSA-wf5f-4jwr-ppcp % python3 mkpickle.py Usage: mkpickle.py output Ex: mkpickle.py 'curl IP:PORT/rce' evil.pickle.gz % python3 mkpdf.py -h usage...

solrradar

Mass Reconnaissance & Exploitation Framework for Apache Solr Velocity Template Injection → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigation Disclaimer...

RCE

This repository does not have a README...

CVE-2024-38856

CVE-2024-38856 Apache Ofbiz RCE Scanner Description This script is designed to scan for the CVE-2024-38856 vulnerability in Apache Ofbiz applications, which may allow for remote code execution. It sends HTTP POST requests to specific paths within the Ofbiz application with malicious payloads to...

CVE-2026-40473

camel-mina MinaConverter.toObjectInput Unsafe Deserialization Reproducer CVE-2026-40473 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-mina component, tracked as CVE-2026-40473. The MinaConverter.toObjectInputIoBuffer type converter wraps the received bytes...

CVE-2026-4631-cockpit-RCE

CVE-2026-4631 — Cockpit Mass Exploit Tool Unauthenticated Remote Code Execution via SSH Command-Line Argument Injection Cockpit versions 327 – 359 | CVSS 9.8 Critical | CWE-78 Tool mass exploitation untuk CVE-2026-4631 pada Cockpit web service cockpit-ws, port 9090. Mendukung mode vulnerability...

CVE-2021-3317

Information Exploit Title: Klog Server 2.4.1 - Command Injection Authenticated Date: 26.01.2021 Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.klogserver.com/ Version: 2.4.1 Description: https://docs.unsafe-inline.com/0day/klog-server-authenticated-command-injection CVE:...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE Exploit An automated exploit and scanner for CVE-2025-34085 , a critical vulnerability in the WordPress Simple File List plugin, enabling unauthenticated remote code execution through arbitrary file upload and rename functionalities....

CVE-2024-8353-PoC

Proof-Of-Concept Code for CVE-2024-8353 This repository contains a script for exploiting the CVE-2024-8353 vulnerability in the GiveWP plugin for WordPress. This vulnerability allows unauthenticated PHP Object Injection, potentially leading to remote code execution. Overview The provided scripts...

CVE-2026-61343-poc-librebooking-rce

CVE-2026-61343-poc-librebooking-rce Librebooking Admin RCE PoC CVE-2026-61343...

shellshock-poc-cve-2014-7169

CVE-2014-6271 - Shellshock PoC Summary CVSS 10.0. Bash improperly parses trailing commands after a function definition stored in an environment variable, executing them during shell initialization. Root cause Bash environment variables can encode function definitions: x=' :; ' When bash imports...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Usage root@kitploit: usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message an...

gitlab-cve-2020-10977

GitLab CVE2020-10977 Introduction This script provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. The CVE is an arbitrary file read which allows you to extract the Rails secretkeybase by downloading the GitLab secrets.yaml file. Which in turn, enables you...

CVE-2021-41773

CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...

CVE-2017-10271

Brief Description Command execution with echo output Direct shell upload Tested OK on Linux with WebLogic 10.3.6.0 Usage python weblogicwlswsatexp.py -t 172.16.80.131:7001 root@kitploit: usage: weblogicwlswsatexp.py -h -t TARGET -c CMD -o OUTPUT -s SHELL optional arguments: -h, --help show this...

CVE-2024-21413-Vulnerabilidad-Outlook-LAB

CVE-2024-21413 – Outlook LAB Vulnerability Vulnerability Description CVE-2024-21413 is a critical vulnerability discovered in Microsoft Outlook that allows a remote attacker to execute malicious links via a carefully crafted email. This exploit uses the file:// protocol to redirect victims to...

IKEV2-POC

EpSiLoNPoInTIkEv2.cpp ⚠️ Project in finalization stage. NOT fully functional in its current state. Description EpSiLoNPoInTIkEv2.cpp is a C/C++ exploit prototype targeting Windows, developed around an exploitation of type double-free inikeext.dll Windows IKEv2 driver, referenced under research as...

CVE-2026-7275-moodle

CVE-2026-7275-moodle PoC & documentation for CVE-2026-7275 : Moodle Google Drive Repository repositorygoogledocs — Path Traversal / Arbitrary File Write that can lead to RCE on unpatched Moodle versions. Disclaimer: For authorized security research, auditing, and defensive education only. Do not...