CVE-2025-6335

Title: Template injection command execution vulnerability in dedeCMS 5.7 sp2 BUGAuthor: Ewoji Affected Version: dedeCMS 5.7.2 Vendor: Shanghai Zhuozhuo Network Technology Co., LTD Software: dedeCMS Vulnerability Files: /include/dedetag.class.php Description: 1. After install，Log in to the...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs is a lightweight and self-hosted Git service similar to a private version of GitHub, designed to run easily on low-resource servers. The CVE-2025-8110 vulnerability is a critical security flaw that allows an attacker to bypass path restrictions by using symlinks. By...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Day Started: 30/07/2024 Check the diff code betwween ver has vuln and ver of code with fix vuln: Code reference 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php Code reference...

CVE-2023-46818

CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash CVE-2023-46818 Authenticated PHP Code Injection in ISPConfig for more details: advisory CVE-2023-46818 PoC Introduction ISPConfig versions Note: This exploit requires valid ISPConfig admin credentials and will deploy a command web she...

CVE-2023-3452-PoC

CVE-2023-3452-PoC - Wordpress Plugin Canto 3.0.5 - Remote File Inclusion RFI - Remote Code Execution RCE - Unauthenticated Here we explain a PoC of the latest RFI Remote File Inclusion vulnerability of the Canto Wordpress Pluging, and we have developed an exploit to automate the execution of...

CVE-2025-4524

CVE-2025-4524 - Unauthenticated madara-core Wordpress theme LFI WordFence link Description A vulnerability lies in madara's madaraloadmore action, where a template parameter is arbitrary data from the user and passed to PHP's include function. Vulnerability A vulnerability lies in madara's...

CVE-2021-26084

CVE-2021-26084 Introduction This write-up provides an overview of CVE-2021-26084 - Confluence Server Webwork OGNL injection 1 that would allow an authenticated user to execute arbitrary code on a Confluence Server or Data Center instance. TL;DR Confluence Server / Data Center makes use of Webwork...

CVE-2025-22785

CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

VMkatz

VMkatz Too Big to Steal You are three weeks into a red team engagement. Your traffic crawls through a VPN, then bounces across four SOCKS proxies chained through compromised jump boxes before it touches the target network. Every packet takes the scenic route. After days of lateral movement you la...

CVE-2019-17147

CVE-2019-17147: TP-Link TL-WR841N Exploitation Overview This repository documents the comprehensive reverse engineering and exploitation of CVE-2019-17147 , a critical remote code execution RCE vulnerability in the TP-Link TL-WR841N router MIPSEL architecture. The vulnerability resides in the htt...

bread

🍞 BREAD BREAD BIOS Reverse Engineering & Advanced Debugger is an 'injectable' real-mode x86 debugger that can debug arbitrary real-mode code on real HW from another PC via serial cable. Introduction BREAD emerged from many failed attempts to reverse engineer legacy BIOS. Given that the vast...

ret-sync

ret-sync ret-sync stands for Reverse-Engineering Tools SYNChronization. It is a set of plugins that help to synchronize a debugging session WinDbg/GDB/LLDB/OllyDbg/OllyDbg2/x64dbg with a disassembler IDA/Ghidra/Binary Ninja. The underlying idea is simple: take the best from both worlds static and...

CVE-2019-1663-Binary-Analysis

Binary Analysis of CVE-2019-1663 Author: Corentin Wolff Origin of the Vulnerability Source of the Vulnerability The vulnerability originates from the function 0x0002BF64, which misuses the strcpy function, making it prone to buffer overflow attacks. For clarity, this function has been renamed to...

hook

Hook Hook exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there is a builtin low privileged user named status that this script...

Embarcadero-Workaround

What is Embarcadero Workaround ? This is an unofficial "patch" for "Embarcadero VCL Library Stack/Heap Overflow" CVE-2014-0993 and CVE-2014-0994. Which Software versions does this workaround support? 32-bit software compiled with Delphi and C++ Builder where the "VCL library" was included, as lon...

CVE-2014-0472

CVE-2014-0472 Use root@kitploit: docker-compose up -d Access localhost:8083 Reference: https://www.djangoproject.com/weblog/2014/apr/21/security/ 1. One or more views are present which construct a URL based on user input commonly, a "next" parameter in a querystring indicating where to redirect...

poorskeme

poorSKeme OSINT - Data Visualization - Blockchain - Awareness - Scam Install Go to this site and click on the downdload button Or go to release section. Download the ZIP file called poorSKeme.zip Unzip it, install requeriments and execute it. root@kitploit: unzip poorSKeme.zip cd poorSKeme pip...

CVE-2022-43271

CVE-2022-43271 Stored Cross-Site Scripting XSS Product: Move CRM https://inhabit.com.au/Move-Real-Estate-CRM-Software Discovery date: 2/8/2022 Fix date: 4/8/2022 Affected Version: version 4, build 260 Fixed Version: version 4, build 261 Description: The vulnerability was discovered in the 'staff...

CVE-2019-7482

Multiple Vulnerabilities in SonicWall SMA/SRA Appliances CVE-2019-7481, CVE-2019-7482,CVE-2019-7483, CVE-2019-7484, CVE-2019-7485, CVE-2019-7486 First Published: 26 Feb 2020 14:00 GMT Status: Developing Last Updated: 26 Feb 2020 14:00 GMT CVSS Score: 9.8 Summary On 18 Dec 2019, SonicWall CSIRT...

CVE-2025-54322

CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE Scanner A multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution vulnerability in XSpeeder SXZOS firmware affecting 70,000+ hosts globally. 📋 Table of Contents About the Vulnerability Features Installation Usa...