21117 matches found
CVE-2024-24919
CVE-2024-24919 This project aims to create an automation to better study CVE-2024-24919. api.py : Collects possible vulnerable IPs. CVE-2024-24919.py : Performs brute force given the IP file and the directories file. worldListLFI.txt : List of Linux directories. Usage Clone this repository on you...
CVE-2017-12637_SAP-NetWeaver-URL-Traversal
CVE-2017-12637SAP-NetWeaver-URL-Traversal Proof-of-concept LFI Scanner: Automated detection of /etc/passwd exposures via directory traversal and regex matching. root@kitploit: LFI Scanner A lightweight Python proof-of-concept to scan target hosts for Local File Inclusion LFI vulnerabilities by...
CVE-2020-5902-Scanner
CVE-2020-5902-Scanner Automated F5 Big IP Remote Code Execution CVE-2020-5902 Scanner Written In Python 3 Vulnerability Description F5 released a Critical Remote Code Execution vulnerability CVE-2020-5902 on 30th June 2020 that affects several versions of Big IP. Attacker can easily exploit RCE &...
CVE-2022-47615
CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated LFI Description Description The plugin does not validate various parameters in the lp/v1/courses/archive-course REST endpoints before using them in include statement, which could lead to LFI issues. How to use root@kitploit: $ python3...
CVE-2025-49132
CVE-2025-49132 - Pterodactyl Panel Unauthenticated RCE root@kitploit: / |\ \ / /| | | / | | | | || | / | || / | | \ V / | || / / | |/ / | | | | , /| || \ / / | / || /| //||/ || // ||/ /| Exploit for Pterodactyl Panel ≤ 1.11.10 - unauthenticated LFI to RCE. The Vulnerability The...
gitlab-12.9.0-file-read
The warn For demonstration purpose and ethical hacking only. The what A wanted to be better script than what can be found on exploit-db about the authenticated arbitrary read file on GitLab v12.9.0 CVE-2020-10977 The how 1. Meet the dependency you probably already have the rest pip3 install...
CVE-2026-87927
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...
CVE-2025-2294
CVE-2025-4403 Exploit Details Published : March 27, 2025 Updated : March 28, 2025 Severity : Critical CVSS Score: 9.8 CWE : CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' Affected Versions : All versions from n/a through 2.5.1 Researcher :...
EUVD-2026-75109
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...
CVE-2026-87927 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...
CVE-2026-87927
MaxSite CMS through version 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers. By supplying base64-encoded path traversal sequences, unauthenticated attackers bypass path validation checks and execute admin-gated handler actions without authentication...
Elastix-2.2.0-CVE-2012-4869
Elastix 2.2.0 Local File Inclusion Exploit - CVE-2012-4869 Description This script exploits a Local File Inclusion LFI vulnerability in Elastix 2.2.0 , allowing remote code execution RCE by injecting commands via the callmepage.php endpoint. The exploit is based on CVE-2012-4869. Features Bypasse...
rwsploit
Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...
LFI-FINDER
🍀 LFI FINDER TOOL 🍀 Written by TMRSWRR Version 1.0.0 Instagram: TMRSWRR 📹 How to use 📹 Click on the image... LFI-FINDER is an open-source tool available on GitHub that focuses on detecting Local File Inclusion LFI vulnerabilities. Local File Inclusion is a common security vulnerability that allow...
CrushFTP-SSTI-LFI-Proof-of-Concept
CVE-2024-4040 — CrushFTP SSTI / LFI Proof of Concept For educational and authorised lab use only. CS443 Software and Systems Security — controlled local Docker environment. Vulnerability Summary...
citrix_adc_netscaler_lfi
citrixadcnetscalerlfiscan This Metasploit-Framework module can be use to help companies to check the last Citrix vulnerabilites disclosed July 08, 2020. CVE-2020-8193 CVE-2020-8195 CVE-2020-8196 Public reporting on July 8th, 2020 by Donny Maasland discussed how the vulnerability could be exploite...
Oracle-WebLogic-CVE-2022-21371
Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Local File Inclusion : CVE-2022-21371 Affected Version: Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 Description: The Oracle Fusion Middleware's Oracle WebLogic Server product Web Container component is vulnerable to local file...
EUVD-2026-74928
Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded ...
CVE-2021-41277
CVE-2021-41277 Metabase GeoJSON map local file inclusion Version: x.40.0-x.40.4 Usage : root@kitploit: chmod -x CVE-2021-41277.sh ./CVE-2021-41277.sh http://ip:port/ /etc/passwd References https://vulners.com/cve/CVE-2021-41277...