CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC 編集可能なApache NiFi ExecuteSQLプロセッサを悪用し、H2のRUNSCRIPTペイロードを使用してBashリバースシェル経由でリモートコマンド実行を誘発する、短いPythonのPoCです。 認可されたテストおよび研究目的のみに使用してください。所有していない、または明示的なテスト許可を得ていないシステムに対して使用しないでください。 動作概要 root@kitploit: ExecuteSQL processor update - H2...

react2shellpoc

이 저장소는 특정 부류의 React Server Component 취약점이 통제된 합법적 교육 환경 내에서 어떻게 동작하는지 보여주는 개념 증명proof-of-concept을 포함하고 있습니다. 매뉴얼 root@kitploit: ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /\ || CVE-2025-55182 React Server Components RCE usage: exploit.py -h -t URL -c CMD...

PowerSploit

This project is no longer supported PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. PowerSploit is comprised of the following modules and scripts: CodeExecution Execute code on a target machine...

crack

crackserver Servidor y cliente XMLRPC para el cracking de hashes crackserver.py - componente de servidor crackclient.py - componente de cliente crack.py - la misma funcionalidad de cracking pero ejecutada localmente en lugar de cliente / servidor Copyright 2011 Stephen Haywood, alias...

brpc

中文版 bRPC is an Industrial-grade RPC framework using C++ Language, which is often used in high performance system such as Search, Storage, Machine learning, Advertisement, Recommendation etc. "bRPC" means "better RPC". You can use it to: Build a server that can talk in multiple protocols on same...

CVE-2001-0933

CVE-2001-0933 Cooolsoft PowerFTP Server 2.03 allows remote attackers to list the contents of arbitrary drives via a ls LIST command that includes the drive letter as an argument, e.g. "ls C:". Securiteam publication at http://www.securiteam.com/exploits/6D00L2A35K.html External info at...

CVE-2022-24716-2

CVE-2022-24716 Icinga Web 2 is an open source monitoring web interface, framework and command line interface. Unauthenticated users can leak the contents of user-accessible local system files from the web server, including icingaweb2 configuration files with database credentials. Installation Usa...

authproof-sdk

AuthProof SDK AuthProof is a cryptographic delegation protocol for agentic AI. Most protocols in this space enforce against an operator-defined policy -- giving the operator authority to expand or reinterpret the user's original intent after the fact. AuthProof is built around a different trust...

CVE-2022-36446-Webmin-Software-Package-Updates-RCE

Webmin 1.997에서 CVE-2022-36446 소프트웨어 패키지 업데이트 RCE 인증 필요를 악용하는 Python 스크립트입니다. 기능 HTTP 및 HTTPS 지원 자체 서명 인증서는 --insecure 옵션 사용. --command 옵션으로 단일 명령 실행. --interactive 옵션으로 대화형 콘솔...

CVE-2019-11043

CVE-2019-11043 php-fpm+Nginx RCE 0x01 phuip-fpizdam-Mac 설치 go get github.com/neex/phuip-fpizdam go install github.com/neex/phuip-fpizdam root@kitploit: ale@Pentest /go go get github.com/neex/phuip-fpizdam ale@Pentest /go go install github.com/neex/phuip-fpizdam ale@Pentest /go ls bin src...

gosec

gosec - Go 보안 검사기 Go AST 및 SSA 코드 표현을 스캔하여 소스 코드의 보안 문제를 검사합니다. 빠른 링크 GitHub 액션 로컬 설치 빠른 시작 일반적인 사용 패턴 규칙 선택 출력 형식 기능 패턴 기반 규칙 for detecting common security issues in Go code SSA 기반 분석기 for type conversions, slice bounds, and crypto issues 오염 분석 for tracking data flow from user input to dangerous...

gosec

gosec - Go Security Checker Inspects source code for security problems by scanning the Go AST and SSA code representation. Quick links GitHub Action Local installation Quick start Common usage patterns Selecting rules Output formats Features Pattern-based rules for detecting common security issue...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — 임의 파일 쓰기 + XML 인젝션 → 원격 코드 실행 목차 개요 취약점 세부 정보 공격 체인 요구 사항 설치 구성 사용법 작동 원리 취약한 코드 사전 공격 체크리스트 테스트 환경 면책 조항 참고 자료 개요 CVE-2025-66034 은 fontTools.varLib 가변 글꼴 생성 파이프라인의 취약점입니다. 웹 애플리케이션이 이 파이프라인을 노출하고 사용자가 제공한 .designspace 파일을 허용하면, 두 가지 약점이 연쇄적으로 작용하...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML 認証バイパス エクスプロイトフレームワーク/ツールキット Oracle WebLogic Server — SAML 認証バイパス → 管理者権限の奪取 エクスプロイトフレームワーク & 一括スキャナ 許可されたセキュリティテスト専用です。 ⚖️ 法的免責事項と責任ある使用 本ツールは、教育および許可されたペネトレーションテストの目的にのみ提供されます。...

ApiHunter

Support Development If this project helps your work, support ongoing maintenance and new features. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. 🎯 ApiHunter 📺 Video Demo Click to watch the full demo on YouTube 🖥️ Desktop App...

root-my-webos-tv

내 webOS TV 루팅하기 간단한 Python 스크립트로, 취약한 webOS 기기에서 root로 텔넷 서버를 시작합니다. 확인된 TV webOS 4.9.7 - 5.30.40 모델 LG43UM7000PLA webOS 5.5.0 - 04.50.51 모델 OLED55CXPUA webOS 6.3.3-442 kisscurl-kinglake - 03.36.50 모델 OLED48C1PUB webOS 7.3.1-43 mullet-mebin - 03.33.85 모델 OLED55A23LA 설치 1. Python 3을...

CVE-2021-42013

CVE-2021-42013 Contributor 석은호@eunho87 CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability Summary A bug in the path normalization handling of Apache HTTP Server 2.4.50 allows arbitrary file reading or remote code execution without authentication. This occurs due to an incomplete patch...

abyss-c2

ABYSS C2 — HiSilicon DVR Exploit Framework ⚠️ EDUCATIONAL / DEMONSTRATION PURPOSES ONLY This software is provided exclusively for educational and authorized security research purposes. It is designed to demonstrate common IoT vulnerabilities and post-exploitation techniques in a controlled,...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager Arbitrary File Write Path Traversal -orange 📋 Description CVE-2026-20262 is a Path Traversal CWE-22 vulnerability in the web interface of Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage. It allows an authenticated attacker with write permission...

CVE-2026-75754

Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...