CVE-2025-46157

CVE-2025-46157 CVE-2025-46157 – Timetrax V1 2025 Remote Code Execution and Privilege Escalation Summary A critical vulnerability was discovered in Timetrax V1 2025 that allows authenticated users to bypass file upload restrictions and achieve remote code execution RCE. The issue exists in the Lea...

CVE-2025-5548

Exploitation and Vulnerability Analysis Document purpose: Reflect on the knowledge acquired during the lab deployment, detail the exploitation process for CVE-2025-5548, and outline the next steps toward unknown vulnerability 0-day research. 1. My Vision on Vulnerability Research Throughout this...

CVE-2025-29556

CVE-2025-29556 – ExaGrid Security Officer Account Creation Bypass 📝 Overview Vulnerability Title : Unauthorized Creation of Security Officer Account Product : ExaGrid EX10 Backup Appliance Version Affected : Tested on current version at disclosure Versions Affected : 6.3 – 7.0.1.P08 CVE ID :...

cve-2025-29927-lab

This repository contains a deliberately vulnerable web application built using Next.js. It is designed to demonstrate and study the security issue known as CVE-2025-29927. The goal of this project is to help security researchers, students, and bug bounty hunters understand how the vulnerability...

apache__activemq_CVE-2014-3576_5-10-1

Welcome to Apache ActiveMQ Apache ActiveMQ is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Getting Started To help you get started, try the following links: Getting Started http://activemq.apache.org/version-5-getting-started.html Building...

gogs

👉 Deploy on DigitalOcean and get $200 in free credits! 🔮 Vision The Gogs /gɑgz/ project aims to build a simple, stable and extensible self-hosted Git service that can be set up in the most painless way. With Go, this can be done with an independent binary distribution across all platforms that Go...

apache__activemq_CVE-2019-0222_5-15-8

Welcome to Apache ActiveMQ Apache ActiveMQ is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Getting Started To help you get started, try the following links: Getting Started http://activemq.apache.org/version-5-getting-started.html Building...

CVE-2025-12399

Alex Reservations: Smart Restaurant Booking = 2.2.3 - Authenticated Admin+ Arbitrary File Upload The WordPress Alex Reservations plugin versions 2.2.3 and prior contains an arbitrary file upload vulnerability that allows authenticated WordPress administrators to upload malicious PHP files to the...

CVE-2025-4396

CVE-2025-4396 - WordPress Relevanssi Time-Based Blind SQL Injection Toolkit Overview This repository contains a practical research and validation toolkit for CVE-2025-4396 , an unauthenticated Time-Based Blind SQL Injection affecting the WordPress Relevanssi plugin through the cats parameter. The...

bitbucket-test

Docker container to investigate CVE-2022-36804 Recreating a remote code execution vulnerability where Bitbucket fails to sanitize user input, which allows attackers to inject Git flags and execute code remotely. This repository documents how I reproduced the vulnerability CVE-2022-36804, an issue...

CVE-2023-48084

CVE-2023-48084 Python exploit for the CVE-2023-48084 - Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. The exploit uses /admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id= to execute SQL queries, and...

CVE-2024-10924-Exploit

CVE-2024-10924-Exploit Really Simple Security Free, Pro, and Pro Multisite 9.0.0 - 9.1.1.1 - Authentication Bypass 📖 Description This script exploits a vulnerability in the Really Simple Security plugin versions 9.0.0 - 9.1.1.1 for WordPress.The flaw allows authentication bypass due to improper...

CVE-2022-21371

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2022-21371 Run bellow command to check CVE-2022-21371 -h Configurations 2. We integrated with the Telegram A...

CVE-2023-4634-PoC

CVE-2023-4634 - RCE Vulnerability in WordPress Plugin Media Library Assistant 1. Build and launch environment root@kitploit: cd Stand docker-compose up --build -d 2. Wait for services to start 60 seconds root@kitploit: sleep 60 curl -I http://localhost:8080 3. Run vulnerability scan...

CVE-2020-3452

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2020-3452 Run bellow command to check CVE-2020-3452 -h Configurations 2. We integrated with the Telegram API...

CVE-2015-1635

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2015-1635 Run bellow command to check CVE-2015-1635 -h Configurations 2. We integrated with the Telegram API...

Axelor-vulnerability-CVE-2025-50341

CVE-2025-50341: Sql Injection on Axelor CVE ID: CVE-2025-50341 Reporter: Milad Seddigh Product: Axelor Affected Versions: v5.2.4 Impact: Sql Injection → exfiltrating database content. Summary A Boolean-based SQL injection vulnerability was discovered in the “domain” parameter of the Axelor. An...

jit

jitpass - just-in-time passwords Just-in-time credentials for your dev machine. Documentation · Quickstart · Supported tools · Command reference · Security Status: macOS-only Apple Silicon, and still in development. What jit is 30 seconds Your secrets live in plaintext all over your machine: .env...

CVE-2025-8088

CVE-2025-8088 – WinRAR Exploit This repository contains a malicious RAR file generator that abuses the CVE-2025-8088 vulnerability in WinRAR, allowing a seemingly legitimate file to execute a payload when the victim extracts it. Recommended command root@kitploit: python3 exploit7.12.py \ -p...

CVE-2025-8088

Technical Deep Dive: CVE-2025-8088 - The Resilient Path Traversal Disclaimer: This content is for educational and research purposes only. Do not use this information for any malicious activities. Today, we're taking a deep dive into a fascinating path traversal vulnerability, tracked as...