POC-CVE-2025-55182

CVE-2025-55182 Advanced Scanner A full-featured exploitation utility for CVE-2025-55182 — Remote Code Execution via React Server Components in Next.js. The scanner automatically crafts the multipart payload and abuses process.mainModule.require'childprocess'.execSync to achieve arbitrary OS comma...

CVE-2022-42889

Quickstart root@kitploit: sudo apt install golang To run like Python: root@kitploit: go run main.go arg1 arg2 To build executable: root@kitploit: go build main.go Usage: root@kitploit: non@woa:/program$ go run main.go - Usage: ./program vulnerable/web?param= 'ls -la' To Do: Reverse shell...

Mohnad-AL-saif-CVE-2020-11107-XAMPP-Local-Privilege-Escalation

🧨 CVE-2020-11107 – XAMPP Local Privilege Escalation Windows 📌 Overview CVE-2020-11107 is a Local Privilege Escalation LPE vulnerability affecting Apache Friends XAMPP on Windows. An unprivileged user can modify the XAMPP Control Panel configuration file xampp-control.ini and replace the default...

CVE-2024-0352

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2024-0352 Run bellow command to check CVE-2024-0352 -h Configurations 2. We integrated with the Telegram API...

CVE-2023-30212

CVE-2023-30212 LAB SETUP Prerequisite Download docker.io sudo apt install -y docker.io STEPS 1. Download all files from my repository using the below command. git clone https://github.com/AAsh035/CVE-2023-30212.git 2. Now to make a docker image run the following command: sudo docker build -t vuln...

CVE-2019-16113

Bludit 3.9.2 - Remote command execution - CVE-2019-16113 This exploit combines two exploits in Bludit CMS 3.9.2 to gain remote code execution on the target system. The original exploits are CVE-2019-17240 & CVE-2019-16113. Features Bruteforce password + RCE Bruteforce username:password + RCE...

CVE-2019-10149-Exim4-RCE

Cr.Exim 4.87 - 4.91 - Local Privilege Escalation Cr.Link: https://www.exploit-db.com/exploits/46996 1.This method requires you to first access the target machine with standard user privileges. 2.Once you have accessed the target machine, create a script file with the following content: vi raptor....

CVE-2017-16245

CVE-2017-16245 Source code for CVE-2017-16245 Avecto Defendpoint bypass originally disclosed by Nettitude The PowerShell implementation of CVE-2017-16245 can and should be copied and pasted straight into PowerShell. If PowerShell is blocked, try to execute powershell.exe from the command prompt...

CVE-RUBY

cve-id 捐赠 您可以通过 PayPal 或扫描下方二维码来支持本项目的维护。 ⚡ 简单使用 仅在安全且经过授权的环境中使用此项目，例如： 本地虚拟机 Docker 容器 隔离的实验室环境 经授权的渗透测试环境 示例设置： root@kitploit: git clone cd Project use python follow below Create a virtual environment python -m venv venv Activate the virtual environment macOS / Linux source venv/bin/activate...

CVE-2025-32433

CVE-2025-32433 – Erlang/OTP SSH RCE Vulnerability 📌 Summary CVE-2025-32433 is a remote code execution RCE vulnerability affecting the Erlang/OTP SSH daemon. The root cause is improper handling of pre-authentication SSH channel requests which can be crafted by an attacker to cause arbitrary comman...

CVE-2025-71389_exploit

CVE-2025-71389 — Cal.com 未认证远程代码执行 react2shell 在 Cal.com = 5.9.9（任意已修复的 Next.js 版本：15.0.5 / 15.1.9 / 15.2.6 / 15.3.6 / 15.4.8 / 15.5.7 / 16.0.7）。不要将 RSC 服务器函数处理器暴露给不受信任的 客户端，也不要让应用容器以 root 身份运行。 免责声明 仅用于授权的安全测试和教育目的。只能针对你拥有 或获得明确测试许可的系统使用。...

CVE-2017-5638

CVE-2017-5638 CVE-2017-5638 Apache Struts2 RCE Exploit 🛠️ Descripción Este es un PoC simple basado en Python para CVE-2017-5638 — una vulnerabilidad de ejecución remota de código en Apache Struts 2. ⚠️ Aviso legal Este código se proporciona solo con fines educativos. NO lo use en ningún sistema sin...

spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...

asf__james-project_CVE-2022-22931_3-6-0

Apache James Project :latestjamesversion: 3.8.0 image:https://img.shields.io/badge/Join%20us-Mailing%20lists-purple.svglink="https://james.apache.org/mail.html" link:https://gitter.im/apache/james-projectimage:https://badges.gitter.im/apache/james-project.svgJoin the chat at...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit Description: This Python script exploits a file upload restriction bypass vulnerability in Pluck CMS e.g., versions prior to 4.7.13 to upload a PHP webshell. Once uploaded, the shell named "shell.phar" can be used to execute commands on the...

CVE-2021-22911

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taki...

CVE-2021-32159

..| CSRFtoCommandInjection1 |.. Description : Exploiting a Cross-site request forgery CSRF attack to get a Command Injection through the Webmin's Upload and Download feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's...

cve-2018-15133

POC - CVE-2018-15133 Usage: root@kitploit: $ ./CVE-2018-15133 -h Usage: ./CVE-2018-15133 options Options: -APIKEY string API key del sitio web de Laravel, codificada en base64 -URL string URL del sitio web de Laravel a atacar -command string Comando a ejecutar en el sitio web vulnerable; si no se...

CVE-2019-0232

CVE-2019-0232 — Apache Tomcat CGI Servlet RCE Educational PoC for authorized CTF / penetration testing only. Running this against systems you do not own or have explicit written permission to test is illegal. Vulnerability Overview CVE-2019-0232 is a Remote Code Execution vulnerability in Apache...

CVE-2025-55182-Attack-Analysis

CVE-2025-55182 攻击分析：React 服务器组件远程代码执行 针对生产环境 Next.js 应用的真实攻击分析 📋 目录 执行摘要 漏洞概述 攻击时间线 技术分析 恶意软件分析 失陷指标（IOCs） 缓解措施与响应 经验教训 参考资料 执行摘要 2025 年 12 月 5 日，我们的生产环境 Next.js 应用遭到攻击者利用 CVE-2025-55182 （React2Shell）的攻击，这是 React 服务器组件中的一个严重远程代码执行漏洞。该攻击试图在我们的服务器上下载并执行 Linux 后门木马。 属性| 值 ---|--- CVE ID|...