capture-the-flag

Capture The Flag! Remaster Linux Live CD images for the purpose of creating ready to use security wargames with pre-installed vulnerabilities to exploit. Requirements You will need the following in order to build the Live CD using the scripts in this project: Linux, with root access using sudo gi...

cve-2019-12735

cve-2019-12735 Docker image that lets me study the exploitation of the VIM exploit here Affected Software Vim 8.1.1365 up to and excluding NeoVim 0.3.6 up to and excluding Install root@kitploit: on Host $ make build $ make run $ make attach This brings you into the container with the vulnerable V...

CVE-2021-32708

CVE-2021-32708 Affected versions of this package are vulnerable to Race Condition. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. How the Exploit Works...

CVE-2024-46507

El script fue probado y construido en Ubuntu Server 20.04 LTS, mientras que Kali Linux se utilizó para la explotación y el recorrido. Este recorrido te guía a través de la explotación del servidor vulnerable que contiene las vulnerabilidades CVE-2024-46507 inyección de comandos y CVE-2024-46508...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

CVE-2022-42096

Backdrop CMS version 1.23.0 Vulnerability Explanation: Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via the Post content. Attack Vectors: The attacker must post something on the "Post content" and insert the XSS payload at the "Body" input,...

CVE-2019-9978

CVE-2019-9978 - Social Warfare WordPress Plugin RCE system'cat /etc/passwd' ✅ Step 2 – Start a Python HTTP Server Use Python to serve your payload: root@kitploit:...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...

CVE-2018-7690

CVE-2018-7690 The SSC REST API contains Insecure Direct Object Reference IDOR vulnerabilities that allow authenticated users access to arbitrary details of the Local and LDAP users via POST method and to arbitrary details of other user's Fortify projects via GET method. Exploit-DB publication at...

parquet-canary-exploit-rce-poc-CVE-2025-30065

Canary Exploit for Parquet CVE-2025-30065 root@kitploit: -. '-. OO OO .-----,--/ ,. ,------. .-----. .----. .-----..------. .-----. .----. .----. ,--. .------. ' .--.\ \ //| .---' .-'/ ,-. / .. / ,-. | | .-' / -. / .. \ / .. \ / .' | | | |'-.\ \ / / | | OO'-' | . / \ '-' | | '--. OO'-' ' . / ...

POC-CVE-2026-60206

CVE-2026-60206 — Oracle WebLogic SAML Auth Bypass CVSS 9.9 — SAML authentication bypass in Oracle WebLogic Server Core. Affected: 12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0 ⚠️ Authorized security testing only. Install root@kitploit: git clone https://github.com/imbas007/CVE-2026-60206.git cd...

CVE-2022-21306

CVE-2022-21306 POC, EXP, chatGPT for me, only some ideas provided, all unusable. code root@kitploit: import json import requests targeturl = "http://127.0.0.1:7001" headers = 'User-Agent': 'Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/58.0.3029.110...

CVE-2025-1661

CVE-2025-1661 Exploit for CVE-2025-1661 - HUSKY – Products Filter Professional for WooCommerce 1.3.6.6 PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2024-55040-Sensaphone-XSS

SENSAPHONE VULNERABILITY DISCLOSURE Summary In mid-September 2024, I identified several medium-to-low severity security issues in the Sensaphone Web600 Monitoring System, including stored cross-site scripting XSS vulnerabilities in the system Setup, Profile, and Zone options. Remote authenticated...

CVE-2024-40422

CVE-2024-40422 Found this on exploit-db, decided to make my own for practice. This exploit will search out the passwd file and print the contents on a vulnerable system. This script exploits a path transversal vulnerability in Devika v1. Credit to Alperen Ergel for finding the vulnerability to...

CVE-2022-30514

CVE-2022-30514 School Dormitory Management System 1.0 - Reflected XSS Exploit Title: School Dormitory Management System 1.0 - Reflected XSS Date: 2022-05-25 CVE: CVE-2022-30514 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

pentesting-multitool

Pentesting-Multitool Introduction Pentesting-Multitool project arises from the need to gather some pentesting tools into one tool. It will be developed using Python3 adding some external libraries as DNSPython, pythonwhois or scapy. The main functions of the script is to collect information about...

CVE-2023-20198-RCE

Fofa root@kitploit: body="window.onload=function url ='/webui';window.location.href=url;" && ishoneypot=false && isfraud=false Usage root@kitploit: usage: CVE-2023-20198-RCE.py -h -u URL -p PROXY -au ADDUSER -ap ADDPASS -du DELUSER -pm PRIVILEGEMODE -em EXPLOITMODE -oc OSCMD -cc CLICMD...

cve-2014-0050

cve-2014-0050 CVE-2014-0050 Vulnerable site sample This project aims to demonstrate the CVE-2014-0050 exploitation for educational purpose. For more informations, see : https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2014-0050--Exploit-with-Boundaries,-Loops-without-Boundaries/...

Log4j_dos_CVE-2021-45105

Log4j2 DOS CVE-2021-45105 Poc root@kitploit: $$::-$::-$$::-$ Versions Affected: all versions from 2.0-beta9 to 2.16.0 This application is based on Spring Boot web application vulnerable to CVE-2021-45105 It uses Log4j 2.16.0 Running the application Run it: root@kitploit: Import the project in Jav...