static-code-analysis-helper

Static-Code-Analysis-Helper Description It detects functions that are likely to cause attack methodologies in many web programming languages ​​and frameworks in your project folder. Helps you perform static code analysis. Note : Many of the functions described here may not cause vulnerabilities...

Mintinstall-object-injection

TR Linux mint yazılım yöneticisi v 7.9.5/9 yanlış yapılandırmadan dolayı obje enjeksiyonu ve keyfi kod çalıştırmamıza neden olmaktadır. EN Linux mint software manager v 7.9.5/9 causes us to execute object injection and arbitrary code due to incorrect configuration root@kitploit: mintinsall TR Min...

CVE-2021-40373

CVE-playsms There is a vulnerability in playsms 1.4.3 that allows potential attackers to execute remote code execution. how to reproduce RCE shell: https://playsms.org/ docker pull playsms/playsms:1.4.3 docker run -d -p 80:80 playsms/playsms login using admin:admin...

CVE-2021-3281

CVE-2021-3281 There is a Directory Traversal vulnerability in django.utils.archive.py, lineno:171, in Class TarArchive. The function call os.path.jointopath, name didn't check the param "name",if someone use this util on windows platform,there'll be a Directory Traversal risk, the POC is:...

CVE-2024-49607

CVE-2024-49607 WP Dropbox Dropins = 1.0 - Unauthenticated Arbitrary File Upload Description: The WP Dropbox Dropins plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to upload arbitrary file...

CVE-2026-67185-Unauthenticated-Path-Traversal-Allows-Arbitrary-File-Read-TinyWeb-

Security Advisory: Unauthenticated Path Traversal Allows Arbitrary File Read TinyWeb Assigned CVE ID: CVE-2026-67185 Summary TinyWeb builds the path of the file to serve by joining the web root with the request URL exactly as it arrives, with no normalization. A remote client that has never...

Exploit for CVE-2026-82901

CVE-2026-82901 — Ultra Addons for Contact Form 7 File Upload...

CVE-2018-6574

main.go and attack.so file is used to exploit CVE-2018-6574 , we are using github because of TLS...

CVE-2019-9624

CVE-2019-9624 Authenticated RCE for Webmin 1.9.0 Webmin 1.900 Authenticated RCE - CVE-2019-9624 Exploit 1. Vulnerability Description CVE-2019-9624 is an authenticated Remote Code Execution RCE vulnerability in Webmin versions up to 1.900. It allows an administrative user to execute arbitrary...

Node_CVE-2023-29017

CVE-2023-29017 | Remote Code Execution via vm2 Sandbox Escape WHS 4th Generation, Class 31 - Kim Geon-woo @gunwoo105 Vulnerability Summary vm2 is a Node.js sandbox library for executing untrusted JavaScript in a restricted environment. Under normal circumstances, code inside the sandbox should no...

CVE-2023-2640-CVE-2023-32629-Interactive-PoC

CVE-2023-2640 & CVE-2023-32629 GameOverLay - Real Host Root Escape PoC An interactive, multi-step Local Privilege Escalation LPE Proof of Concept PoC targeting the Ubuntu Linux kernel OverlayFS vulnerabilities CVE-2023-2640 / CVE-2023-32629. Unlike standard automated one-liners that trap your...

CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 - Krayin CRM RCE xpl0ited by infrar3d This is a Remote Code Execution RCE proof-of-concept specifically designed for Krayin CRM v2.2.x, an open-source customer relationship management system. The script automates the exploitation of a file upload vulnerability in the CRM's...

CVE-2025-65482-XXE-

CVE-2025-65482 XXE XML External Entity Injection XXE in XDocReport Bug Definition XML External Entity Injection Vulnerability Overview XML External Entity Injection XXE is a vulnerability in the processing of XML formatted data, where a user injects XML data that references an external file or...

CVE-2025-14847

mongoExploit CVE-2025-14847 mongoExploit is a Proof-of-Concept PoC exploit tool for CVE-2025-14847 , a memory leak vulnerability in MongoDB. This tool exploits a bug in zlib decompression to leak server memory via BSON field names. By crafting a BSON payload with an inflated document length, it...

CVE-2025-68055-poc

CVE-2025-68055 Authenticated SQL injection in Hydra Booking Plugin get function, Hydra Booking hardcodes user input directly into the raw sql request instead of using prepare to sanitize input, leading to Time-Based Blind SQL injection. Exploit A simple run command as such will tell you whether o...

Exploit for CVE-2026-97163

CVE-2026-97163 — UP Plugin GitHub Remote Code Installation Jo...

external_curl_AOSP10_r33_CVE-2021-22924

root@kitploit: | | | | | | / | | | | | | | | | || | | | |/|| \| README Curl is a command line tool for transferring data specified with URL syntax. Find out how to use curl by reading the curl.1 man page or the MANUAL document. Find out how to install Curl by reading the INSTALL document...

CVE-2023-22047---Oracle-PeopleSoft-LFI

CVE-2023-22047---Oracle-PeopleSoft-LFI CVE-2023-22047 is a critical unauthenticated Local File Inclusion LFI vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit allows an attacker to read arbitrary files from the target server without any authentication...

Exploit for CVE-2026-97161

CVE-2026-97161 — UP Plugin Path Traversal / File Read Joomla...

CVE-2025-32433-PoC-Analysis

FAQ - CVE-2025-32433 1. What is Erlang OTP? Erlang is a general-purpose programming language. OTP Open Telecom Platform is a collection of middleware, libraries, and design principles used for fault tolerance using the BEAM VPN. 2. Why is this version of Erlang vulnerable? OTP 26.2.5.10 is...