CVE-2018-6574

CVE-2018-6574 Steps to reproduce: 1. Create a .c file containing the malicious command revshell: root@kitploit: include include static void malicious attributeconstructor; void malicious system""; 2. Compile it using GCC. You must compile it on the exact architecture and OS as the target e.g. Lin...

CVE-2022-26134-LAB

CVE-2022-26134-LAB Confluence Server 和 Confluence Data Center 存在一个严重的未认证远程代码执行漏洞，被标识为 CVE-2022-26134，根据 Atlassian 于 2022 年 6 月 2 日发布的安全公告。该漏洞在 6 月 2 日公布时尚未被修补，并已在野外被利用。截至 6 月 3 日，已有补丁和临时解决方案可用。 本仓库仅用于实验和教育目的。 依赖项 Docker Nuclei 易受攻击的 Confluence 环境 运行易受攻击的环境 root@kitploit: docker-compose up...

CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2026-88854 Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2026-88854

CVE-2026-88854 is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension (mod_osgallery_search) affecting Joomla getVar()—not a real Joomla filter method—so only HTML tags are stripped while quotes and SQL syntax pass through. The value is concatenated directly into a LIKE clau...

EUVD-2026-83767

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

CVE-2024-11680

ProjectSend CVE-2024-11680 漏洞利用 这是针对 CVE-2024-11680 的概念验证漏洞利用代码，该漏洞是 ProjectSend 中一个无需身份验证的配置修改与 Web Shell 上传漏洞。 描述 该漏洞利用工具利用了 ProjectSend 中的多个漏洞： 允许修改配置的 CSRF 令牌绕过 不安全的客户端注册设置 无限制文件上传，导致远程代码执行 环境要求 Python 3.x 所需的 Python 包： root@kitploit: pip install requests colorama 使用方法 root@kitploit: python3...

CVE-2026-88856 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions updateOSGallery, reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passi...

EUVD-2026-83765

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions updateOSGallery, reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passi...

CVE-2026-88856

OrdaSoft Joomla Gallery extension for Joomla versions

CVE-2026-88856 Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla 6.2.7 - The extensions updateOSGallery, reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passi...

POC-CVE-2022-26671

如果你来到这里，你明白为什么需要创建这个仓库。 CVE-2022-26671 GET /AT/ATDefault.aspx 第430行包含明文凭据。 secom | supervisor 关于负责任的披露，当它是登录页面时，不披露硬编码的明文HTTP响应体是愚蠢的。 https://nvd.nist.gov/vuln/detail/CVE-2022-26671...

CVE-2025-2294

CVE-2025-2294 - WordPress Kubio AI 页面构建器 = 2.5.1 - 本地文件包含 LFI 漏洞利用 概述 CVE-2025-2294 影响 WordPress 的 Kubio AI 页面构建器 插件（版本 2.5.1 及以下）。该插件通过 thekubiohybridthemeloadtemplate 函数存在一个未经认证的本地文件包含 LFI 漏洞。 此漏洞允许攻击者在易受攻击的 WordPress 服务器上包含并执行任意文件，可能导致： 绕过访问控制 读取敏感服务器文件 远程代码执行（如果攻击者能够上传伪装成安全文件类型的恶意 PHP 文件） 漏洞详...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

CVE-2022-43097

CVE-2022-43097 All details about CVE-2022-43097 Software: Phpgurukul User Registration & User Management System v3.0 Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Description: Phpgurukul User Registration & User Management System v3.0 w...

CVE-2022-37209

CVE-2022-37209 CVE-2022-37209 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2025-24813-PoC

CVE-2025-24813-PoC CVE-2025-24813 影响 Apache Tomcat —— 如果使用的是存在漏洞的版本且配置严重不当，攻击者只需一次 GET 和一次 POST 即可实现 RCE。 更多信息请点击此处 此脚本来自 Yiheng An、Jun Li、Qiang Liu、Haozhe Zhang、Qi Deng 近期发布的分析文章，经修改后可接受命令、生成所有 ysoserial gadget 载荷并将其发送至目标。 分享此脚本旨在促进道德安全测试。 使用示例： root@kitploit: python3 exploit.py --command 'curl...

CVE-2022-23222

CVE-2022-23222 如果你只想构建并运行这个东西，点这里。 下面大致是对这篇中文文章（writeup）的翻译， 原文见此处。 我们将以 5.13.0 版本的主线内核代码作为参考。 可用的指针类型与检查其边界的函数之间存在不匹配。 这种不匹配最早在 Linux 5.8 中引入，此后已被修补。 可用指针类型的列表见 此处。c / types of values stored in eBPF registers / / Pointer types represent: pointer pointer + imm pointer + u16 var pointer + u16 var ...

sfuzz

SFUZZ Start date: Dec, 2021 This is a coverage-guided, emulation based greybox fuzzer that makes use of a custom Just-In-Time compiler to achieve near-native performance. It works by lifting RISC-V elf binaries to an intermediate representation before JIT compiling them to x86 during execution...

SharpWnfSuite

SharpWnfSuite Este es el repositorio de herramientas para Windows Notification Facility WNF. Actualmente, se ha subido una adaptación en C de las herramientas de wnfun desarrolladas por Alex Ionescu @aionescu y Gabrielle Viala @pwissenlit. Cuando desarrolle herramientas adicionales para Windows...