CVE-2026-62380

A flaw was found in the Netty SOCKS client encoders. This vulnerability allows a remote attacker to inject null bytes or Carriage Return Line Feed CRLF characters into domain address and authentication fields due to insufficient validation. By manipulating these fields, an attacker can truncate o...

CVE-2018-14714-POC

CVE-2018-14714-POC 25 Abr 2020, Altin Thartori, github.com/tin-z Detalles de la vulnerabilidad Inyección de comandos del sistema en appGet.cgi en ASUS RT-AC3200 versión 3.0.0.4.382.50010 permite a los atacantes ejecutar comandos del sistema a través del parámetro URL "loadscript" Referencias para...

CVE-2022-0739

CVE-2022-0739 Python PoC Exploit para CVE-2022-0739 Características Búsqueda de metadatos de base de datos Volcado de credenciales de usuario de Wordpress Inyección arbitraria de consultas ciegas 💉 Uso root@kitploit: usage: cve-2022-0739 -h -u URL -e EXEC options: -h, --help show this help messag...

unomi_exploit

Disclaimer The vulnerability detection methods, files, and other content provided here are strictly limited to use by security professionals under legal authorization, for the purpose of testing the security of authorized servers. Security professionals must comply with legal regulations and are...

CVE-2026-18408

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

CVE-2019-11043

PoC CVE-2019-11043 A Python version of the CVE-2019-11043 exploit https://github.com/neex/phuip-fpizdam This PoC is still a draft, please use the exploit written by @neex Vulnerability Analysis: https://paper.seebug.org/1064/ PoC Setup Just run docker compose to bring up nginx and php-fpm:...

havij

Havij – SQL Injection Tool Linux Native Havij is a native Linux port of the classic Havij 1.15 Pro SQL injection tool. It replicates the original interface, dark theme, and green‑text aesthetic — but runs natively on Linux using Python and PyQt6. ⚠️ Disclaimer: This tool is for educational and...

CVE-2020-8958

CVE-2020-8958 CVE-2020-8958 : Exploit de Ejecución Remota de Código Autenticada para Routers NetLink usando el servidor boa. Puntuación CVSS: 7.2 Tipos de Vulnerabilidad: OS Command Injection Autenticación: Requerida Modelos Afectados: HG323 Descripción El recurso /boaform/admin/formPing en los...

EUVD-2026-68526

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8...

CVE-2026-19702

CVE-2026-19702 is an OS command injection vulnerability in TÜBİTAK BİLGEM's Pardus Boot Repair , caused by improper neutralization of special elements used in an OS command. The issue affects versions 1.0.7 through 1.0.7 (fixed in 1.0.8 ). The CVSS 3.1 score is 7.8 (HIGH) with a local attack vect...

CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 es una vulnerabilidad de inyección SQL SQLi no autenticada que afecta al plugin WP Ticket Customer Support Ticket System & Helpdesk para WordPress hasta la versión 6.0.4 inclusive. El fallo se produce porque el plugin toma el parámetro de búsqueda s de WordPress y lo...

CVE-2026-60137

wpsqli - WordPress SQLi Extractor CVE-2026-60137 A fast, menu-driven database extraction tool exploiting the authornotin SQL injection vulnerability in WordPress core. This tool focuses purely on database enumeration and dumping, utilizing the REST batch route confusion CVE-2026-63030 to reach th...

CVE-2023-20887

CVE-2023-20887 POC para CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight RCE no autenticado Análisis Técnico Un análisis de la causa raíz de la vulnerabilidad se puede encontrar en mi blog:...

CVE-2022-22909

CVE-2022-22909 Description A Code Injection vulnerability has been found on the Hotel Druid v3.0.3 application, which an attacker could exploit to execute remote code on the server. For a successful exploitation, an attacker should have the privilege to add a new room. Vulnerability description T...

CVE-2024-4577

CVE-2024-4577, Inyección de Argumentos en PHP-CGI root@kitploit: ./CVE-2024-4577.sh /path/to/domains-list POC : root@kitploit: POST /test.hello?%ADd+allowurlinclude%3d1+%ADd+autoprependfile%3dphp://input HTTP/1.1 Host: host User-Agent: curl/8.3.0 Accept: / Content-Length: 23 Content-Type:...

CVE-2024-50603

CVE-2024-50603: Aviatrix Controller Unauthenticated Command Injection CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-50603 with Asychronous Performance. Installation root@kitploit: git clone https://github.com/th3gokul/CVE-2024-50603.git cd CVE-2024-50603 pip instal...

exploit-CVE-2022-24780

استغلال ثغرة iTop RCE عبر SSTI - CVE-2022-24780 iTop --debug exploit.rb light --debug exploit.rb -h | --help full: استغلال باستخدام متصفح محاكى، تنفيذ JavaScript، الحفاظ على معلومات ملف المستخدم الأصلي light: مجرد تحليل HTML وإرسال الطلبات، بدون JavaScript، تدميري إعادة تعيين معلومات المستخدم:...

AOSP-DownloadProviderDbDumper

AOSP-DownloadProviderDbDumper PoC que explota la inyección SQL en el proveedor de descargas de Android CVE-2018-9493 Aviso de seguridad https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf Más información...

EUVD-2026-68519

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...