419558 matches found
wordpress-rce-vapt-cve-2020-25213
WordPress RCE Exploitation & Mitigation CVE-2020-25213 📌 Project Overview This project was developed as part of the IE4012 – Offensive Hacking Tactics & Strategies module. It demonstrates a full cybersecurity attack lifecycle in a controlled lab environment, including: Social engineering attack...
public-passwd
!WARNING Only use this on systems you own or have authorisation to test. It is recommended to keep a root shell open if you won't be able to reboot the system in case of failure, as you may not be able to clear the page cache for /etc/shadow without root. public-passwd Use CVE-2026-46333 and...
CheckPlz
CheckPlz CheckPlz is an Rust adaptation of the populars ThreatCheck & GoCheck tools, designed to scan files for potential threats while leveraging AMSI Antimalware Scan Interface and Windows Defender. By isolating malicious content with precision and providing comprehensive analysis, CheckPlz...
CVE-2020-5377
CVE-2020-5377 CVE-2020-5377: Dell OpenManage Server Administrator File Read root@kitploit: Usage: python3 CVE-2020-5377.py :...
CVE-2026-95499
CVE-2026-95499 affects JosephChuks php-file-manager-with-code-editor up to version 3.0 . The flaw resides in the move_uploaded_file function within filemanager.php , where manipulation of the files argument permits unrestricted file upload by a remote, unauthenticated attacker. The CVSS v3.1 base...
EUVD-2026-84393
A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...
INPGer
INPGer | CVE-2022-4063 - InPost Gallery Automatic Mass Tool for checking vulnerability in CVE-2022-4063 - InPost Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh...
CVE-2025-3515
CVE-2025-3515 CVE‑2025‑3515 — Drag and Drop Multiple File Upload for Contact Form 7 Description: Arbitrary file uploads via drag‑and‑drop‑multiple‑file‑upload-contact‑form‑7 ≤1.3.8.9 allow upload of .phar files, leading to remote code execution in Apache+modphp :contentReferenceoaicite:29index=29...
CVE-2023-31718
CVE-2023-31718 Its possible to include local files into the endpoint /api/download. This endpoint is to download reports from the FUXA and can read local files from HTTP GET "name" parameter. /api/download?cmd=REPORT-DOWNLOAD&name=../../../../../../etc/passwd Name Affected product: FUXA Version...
CVE-2025-1661
CVE-2025-1661 - Unauthenticated Local File Inclusion LFI in HUSKY – Products Filter Professional for WooCommerce Description The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion LFI in all versions up to and including 1.3.6.5 via the...
PoC-CVE-2021-41773
CVE-2021-41773 Apache HTTP Server Path Traversal Exploit A Python exploit for CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows reading arbitrary files from the server. Vulnerability Details CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Serv...
CVE-2022-0847-DirtyPipe-Exploit
CVE-2022-0847-DirtyPipe Vulnerability Overview On March 7, foreign security researcher Max Kellermann published a blog disclosing a local privilege escalation vulnerability CVE-2022-0847 in the Linux kernel: https://dirtypipe.cm4all.com/ CVE-2022-0847 is a local privilege escalation vulnerability...
CVE-2026-4885
CVE-2026-4885 – Piotnet Addons for Elementor Pro Mass Exploit Unauthenticated arbitrary file upload leading to Remote Code Execution RCE in Piotnet Addons for Elementor Pro ≤ 7.1.70. This tool is designed for mass exploitation – feed it a list of targets, and it will automatically: Detect the...
CVE-2025-4602
eMagicOne Store Manager for WooCommerce = 1.2.5 - Unauthenticated Arbitrary File Read The eMagicOne Store Manager for WooCommerce plugin exposes a remote management protocol endpoint ?connector=bridge that allows file deletion operations on the server. The authentication mechanism relies on a...
CVE-2025-58440
CVE-2025-58440 Remote Code Execution RCE via Polyglot File Attack and Null Byte Injection on Laravel FileManager Overview The unisharp/laravel-filemanager package versions 2.11 are vulnerable to Remote Code Execution RCE due to improper file type validation during file uploads. The vulnerability...
Ghostcat-Tomcat-AJP-Exploit-Py3
Tomcat Ghostcat CVE-2020-1938 / CNVD-2020-10487 Vulnerability Detection Tool Introduction This project provides a Python verification script for verifying the Apache Tomcat AJP protocol local file inclusion vulnerability commonly known as Ghostcat, CVE-2020-1938 / CNVD-2020-10487. This script is ...
CVE-2026-54337-PoC
CVE-2026-54337 PoC CVE-2026-54337 - Unauthenticated File Write/Overwrite in fireshare = 1.16.3 PoC For more information please refer to this Github advisory Setup Please use the following docker-compose.yml to test root@kitploit: services: fireshare: containername: fireshare-temp image:...
postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin
A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...
CVE-2026-0740
CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Unauthenticated Arbitrary File Upload to RCE Exploit for CVE-2026-0740 discovered by Selim Lanouar whattheslime. For a complete technical deep dive, read the full article on Lexfo's blog. Disclaimer This repository is provided for research and...
