CVE-2022-35914

CVE-2022-35914 PoC 参考资料 https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc（感谢 Sébastien Copin 提供的 PoC，我在此进行了改编） 在此查看我的完整文章：https://link.medium.com/tBwDlpQl3Ib 用法 root@kitploit: pip install -r requirements.txt root@kitploit:...

CVE-2023-24488

CVE-2023-24488 针对 CVE-2023-24488 的 POC Citrix Gateway 开放重定向与 XSS CVE-2023-24488 URL 查询参数在放入 HTTP Location 头之前未进行充分清理。攻击者可以利用这一点创建链接，当受害者点击该链接时，会被重定向到任意位置。或者，攻击者可以在 Location 头中注入换行符，以提前结束 HTTP 头，并在响应主体中注入 XSS 载荷。 安装要求 root@kitploit: pip3 install -r requirements.txt 用法： root@kitploit: usage: python...

CVE-2017-18044-Exploit

CVE-2017-18044 Native POC This is a dead simple POC for the CVE-2017-18044 command injection vulnerability in Commvault v11 SP5 and older. For metasploit users, a ruby version of the exploit is also bundled with the lastest build...

exploit-CVE-2019-14530

OpenEMR CVE-2019-14530 漏洞利用 OpenEMR --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder Filename of the file to be read Username of the admin Password of the admin --debug Display arguments -h, --help Show this screen Examples: exploit.rb exploit...

exploit-CVE-2018-15139

OpenEMR CVE-2018-15139 漏洞利用程序 OpenEMR --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder Filename of the shell to be uploaded Username of the admin Password of the admin --debug Display arguments -h, --help Show this screen Examples: exploit.rb...

CVE-2025-24893_Analysis

CVE-2025-24893 - XWiki SolrSearch SSTI 导致未认证 RCE 一个自包含的 Docker 实验环境，用于复现 CVE-2025-24893——XWiki SolrSearch RSS 源中的服务端模板注入（Server-Side Template Injection，SSTI），该漏洞可导致未认证的远程代码执行（RCE）。它运行存在漏洞的 15.10.10 版本和已修复的 15.10.11 版本，因此可以展示同一个请求在一个版本上成功、在另一个版本上失败。 关于 AI 工具使用的说明。 在准备本项目时，我有限地使用了两个 AI 助手——Anthropi...

CVE-2021-43799

CVE-2021-43798 Grafana 8.x 路径遍历（未授权） 所有功劳归功于 j0v 及其推文 https://twitter.com/j0v0x0/status/1466845212626542607 免责声明 本内容仅供教育用途。我不会为你的行为承担任何责任。请自行斟酌使用。 本着善意，我一直推迟发布此 PoC，直到该漏洞公开或补丁可用为止。 目录 说明 - 解释该漏洞 攻击向量 - 可以实施的攻击列表 利用脚本 - 利用脚本的使用说明 说明 我注意到 j0v 的推文，声称发现了 Grafana 路径遍历漏洞。出于好奇，我开始查看 Grafana...

CVE-2022-1388

CVE-2022-1388 F5 BIG-IP 未授权远程代码执行漏洞 F5 BIG-IP iControl REST身份验证绕过RCE漏洞 fofa keywords: title="BIG-IP- Redirect" 用法 攻击 root@kitploit: $ python3 cve-2022-1388.py -t https://203.xxx.xxx.xxx + https://203.xxx.xxx.xxx is vulnerable input your command:...

F5-BIG-IP-exploit

F5-BIG-IP 漏洞利用 CVE-2022-1388 用法: CVE-2022-1388.py -h -u URL -c COMMAND -f FILE CVE-2022-1388 F5 BIG-IP iControl REST 认证绕过远程代码执行 例如： root@kitploit: python3 CVE-2022-1388.py -u https://127.0.0.1 python3 CVE-2022-1388.py -u https://127.0.0.1 -c 'cat /etc/passwd' python3 CVE-2022-1388.py -f urls.txt...

EUVD-2026-74285

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639

Sylius (Open Source eCommerce Framework on Symfony) versions 2.0.0 through before 2.0.18, 2.1.15, and 2.2.6 are affected by an IDOR on Shop Payment Request API endpoints. The GET/PUT /api/v2/shop/payment-requests/{hash} and POST /api/v2/shop/orders/{tokenValue}/payment-requests endpoints perform ...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2026-53639 Sylius: IDOR on Shop Payment Request API endpoints

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the GET /api/v2/shop/payment-requests/hash and PUT /api/v2/shop/payment-requests/hash endpoints look up the payment request solely by the hash from the URL. No...

CVE-2023-20198

CVE-2023-20198 CVE-2023-20198 的漏洞利用 PoC 描述 CVE-2023-20198 的特点是路径验证不当，可绕过 Nginx 过滤并访问 webuiwsmahttp Web 端点，而无需进行身份验证。 通过绕过端点身份验证，攻击者可以执行任意 Cisco IOS 命令或使用 Privilege 15 权限发布配置更改。 Cisco 对先前未公开漏洞的活跃利用调查显示，威胁行为者首先利用 CVE-2023-20198 添加了一个具有 Privilege 15 级别的新用户。进一步的攻击涉及利用 CVE-2023-20273 将权限提升到底层 Linux OS...

CVE-2018-17431-Comodo

CVE-2018-17431-PoC Proof of consept for CVE-2018-17431 Exploit Title: Comodo Firewall & Central Manager UTM All Release before 2.7.0 & 1.5.0 Remote Command Execution Web Shell based Exploit Author: Milad Fadavvi Vendor Homepage: https://www.comodo.com/ Software Link:...

Aegis aegis-v0.14.1-alpha

AEGIS Independent, OS-level observability for AI coding agents Watches what AI agents actually do on your machine — processes, files, network — from outside the agents, no hooks required. AEGIS is an independent, OS-level observer for AI agents. It watches agent processes, file access, and networ...

CVE-2025-30208-Vite

CVE-2025-30208 | Vite Script This tool is used to detect whether the target system has the CVE-2025-30208 vulnerability. This vulnerability allows an attacker to read sensitive files such as /etc/passwd or C:\windows\win.ini from the server via a specific path. The tool supports single URL...

winrar-cve-2023-38831-poc-gen

CVE-2023-38831 Exploit Generator This tool is a Python script that exploits a vulnerability in the RAR file format CVE-2023-38831 to execute a malicious command when a user opens a bait file. The exploit works on WinRAR versions before 6.23. For Example 6.22, 6.21, 6.20 or above. Requirements...

CVE-2021-43798

CVE-2021-43798 root@kitploit: ┌─✗─s1gh@parrot─/Desktop └──╼ $ python3 grafanapathtraversal.py -H "http://example-url:3000" Read file /etc/passwd root:x:0:0:root:/root:/bin/ash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin...