CVE-2024-4577

Just for researching Poc For Default XAMPP root@kitploit: curl -v -d "" http://127.0.0.1/php-cgi/php-cgi.exe/?%add+allowurlinclude%3Don+-d+autoprependfile%3Dphp%3A//input+-d+cgi.forceredirect%3D0...

CVE-2023-34960

CVE-2023-34960 Chamilo Command Injection with auto upload shell. use ur logic check path directory at your result vuln, then you can find your access shells wso.php To Install & Execute root@kitploit: $ git clone https://github.com/Mantodkaz/CVE-2023-34960 $ cd CVE-2023-34960 $ pip install -r...

CVE-2023-25292

CVE-2023-25292 Reflected Cross Site Scripting XSS in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain sensitive information via the GOLANGUAGE cookie Vulnerability Details Product: Group Office Application Version: 6.6.145 Vulnerability Type:...

rails-PoC-CVE-2016-2098

A Proof of Concept of vulnerability: CVE-2016-2098 University project created by @alejandro-marting where we can check the vulnerability 2096 Using: rails 4.2.5.1 view has a vulnerable code app/views/poc/render1.html.erb !...

D-Link-NAS-CVE-2024-10914-

D-Link-NAS-CVE-2024-10914- This is a D-Link RCE vulnerability detection program Vulnerability Overview D-Link DNS-320, etc., are NAS Network Attached Storage devices from D-Link China. Multiple D-Link products have a security vulnerability, which stems from erroneous operations on the parameter...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2016-10993

CVE-2016-10993 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://themesinfo.com/scoreme-wordpress-theme-design-496 Proof of Concept PoC https://example.com/?s=%22%2F%3E%3C%2Fscript%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E Refrensi...

CVE-2024-2387

CVE-2024-2387 Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms = 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integrationid Description The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets an...

struts_hack

This tool uses an exploit in the Apache Struts framework called CVE-2017-5638 to gain access to a vunerable server through an OGNL injection. It can be downloaded here you will need to run it from the command line Usage:...

CVE-2020-11981-PoC

Example Build demo stand root@kitploit: docker-compose up -d VM docker-container: 172.18.0.2 Command PoC root@kitploit: docker build -t scan11981 . docker run -v /tmp/:/output --network exploit -t scan11981 --targets 172.18.0.2:6379 --output /output/result.txt cat /tmp/result.txt INFO Vulnerabili...

CVE-2023-43838

CVE-2023-43838 An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar. Additional Information 1. Create alert.svg with the following content: root@kitploit:...

CVE-2025-29927

🕷️ Next.js CVE-2025-29927 🧑🏻‍💼 Legal Disclaimer This project is a Next.js application that has been intentionally configured to be vulnerable to an Authorization Bypass in Next.js Middleware CVE-2025-29927. It is provided solely for lawful, educational, and research purposes. By accessing, using,...

CVE-2020-15052

CVE-2020-15052 : Artica Proxy before 4.28.030418 Community Edition allows SQL Injection. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000 active servers,...

CVE-2026-79483-FastGPT-NoSQL-Injection

CVE-2026-79483-FastGPT-NoSQL-Injection English | 中文 Vulnerability Overview...

CVE-2023-6000-POC

General Details CVE-ID : CVE-2023-6000 CVSS Score : 6.1 Type : Stored XSS Fixed Version : Popup Builder 4.2.3 This vulnerability allows an attacker to exploit a Cross-Site Scripting XSS flaw in the WordPress Popup Builder plugin. The plugin fails to prevent regular visitors from modifying existin...

claude-XML-injection

Claude Sonnet 4.6 — Credential Fabrication via XML Tag Injection Reported: June 14, 2026 | Patched: June 20, 2026 | Anthropic Response: None 56 days Researcher: X1NON Affected Model: Claude Sonnet 4.6 and other non-Haiku Claude models Severity: High CVSS 8.7 Status: Patched — No bounty awarded, n...

CVE-2020-9483

CVE-2020-9483 PoC of SQL Injection vulCVE-2020-9483,Apache SkyWalking Usage:python3 CVE-2020-9483.py -ip 127.0.0.1 You can use this script to get Database version by SQL Injection Click star if you like this script 如果觉得这个PoC帮助了你，希望能点个star Result： XD...

Project-Exploitation-of-Webmin-Authentication-Vulnerability

Research Objective: To conduct a comprehensive analysis and successful exploitation of a Remote Code Execution RCE vulnerability in Webmin version 1.890 CVE-2019-15107, ultimately gaining full control over the target system. Methodology: Initial Reconnaissance: Network scanning performed using...

cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi to RCE This repository contains a local lab and a short exploit for the Drupal JSON:API PostgreSQL SQL injection described in the Ambionics article. The important part of the exploit is the PostgreSQL escalation: once the injection can evaluate a SELECT...

CVE-2021-3156

CVE-2021-3156 Introduction This repository was created for studying purpose. The project contains some tools for studying the sudo Baron Samedit vulnerability and the exploit for it. Thanks to Qualys Team for discovering such vulnerability, to Worawit and 0xdevil for the interesting writeups. Usa...