CVE-2018-16763

Fuel CMS 1.4.1 - Remote Code Execution FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Install root@kitploit: git clone https://github.com/Trushal2004/CVE-2018-16763.git cd...

D-Link

CVE-2024-10914 D-Link Remote Code Execution RCE D-Link NAS- Command Injection via Name Parameter CVE-2024-10914:- A vulnerability was found in D-Link DNS-320, DNS- 320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgiusera...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb remote code execution | cve-2022-22980 poc Description A Spring Data MongoDB application is vulnerable to SpEL injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value...

CVE-2024-34327

CVE-2024-34327 SQL Injection Vulnerability Checker This script V-24-02-001SQLiCheck.py is a proof-of-concept PoC tool to verify the presence of a time-based blind SQL injection vulnerability affecting the password-reset-token.php endpoint, identified as CVE-2024-34327. ⚠️ Disclaimer This tool is...

CVE-2025-43919

CVE-2025-43919: Directory Traversal in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43919 Severity: 5.8 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Attack Type: Remote Affected Software: GNU Mailman...

CVE-2025-25616

CVE-2025-25616 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing students to modify exam rules. The affected endpoint is /exams/edit-rule?examruleid=1. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Student. Step 2: Browse to the following endpoint:...

pyghidra-mcp

PyGhidra-MCP - Ghidra Model Context Protocol Server Overview pyghidra-mcp is a command-line Model Context Protocol MCP server that brings the full analytical power of Ghidra, a robust software reverse engineering SRE suite, into the world of intelligent agents and LLM-based tooling. It bridges...

CVE-2019-6693

CVE-2019-6693 Decrypt FortiGate configuration secrets Original advisory Vendor advisory For Fortigate VM/appliances below versions 6.2.0, 6.0.0 to 6.0.6, 5.6.10 configuration secrets are stored encrypted with a unique key. For versions above the non-default private-data-encryption parameter lets...

CVE-2023-31705

CVE-2023-31705 description A Reflected Cross-site scripting XSS vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter. Vulnerability Type Cross Site Scripting XSS Vendor of Product Sourcecodster Affected Produc...

CVE-2021-38817-Remote-OS-Command-Injection

CVE-2021-38817-Remote-OS-Command-Injection Authenticated Remote OS Command Injection/Remote Code Execution in TastyIgniter v3.0.7 Sendmail web part CVE-2021-38817 An authenticated remote OS command injection vulnerability exists in the TastyIgniter v3.0.7 Restaurtant CMS Sendmail configuration me...

CVE-2020-13094

Title: Dolibarr 11.0.3 - Persistent Cross-Site Scripting Author: Mehmet Kelepce / Gais Cyber Security Date : 2020-04-14 Vendor: https://www.dolibarr.org/ Exploit-DB Author ID: 8763 Remotely Exploitable: Yes Dynamic Coding Language: PHP CVSSv3 Base Score: 7.4 AV:N, AC:L, PR:L, UI:N, S:C, C:L, I:L,...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destructive proof-of-concept and verification harness for CVE-2026-60137 , a blind SQL injection in WordPress core WPQuery::authornotin, reachable via the REST API's authorexclude parameter. Root Cause WPQuery::getposts builds SQL by...

CVE-2025-2812

CVE-2025-2812 — SQL Injection Vulnerability in "Bilet Satış Otomasyonu" by Mydata Bilişim Ltd. Şti 📌 CVE-ID: CVE-2025-2812 📢 USOM Announcement: tr-25-0099 🛡️ Vulnerability Type: CWE-89 - SQL Injection Boolean-based Blind 🏢 Affected Product: Bilet Satış Otomasyonu – Mydata Bilişim Ltd. Şti 🌐 Exampl...

CVE-2024-10571

CVE-2024-10571 Chartify – WordPress Chart Plugin = 2.9.5 - Unauthenticated Local File Inclusion via source Description The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This make...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 Joomla Unauthenticated Information Disclosure Description Supports high-concurrency detection Write url into urls.txt, only supports http://ip:port & https://ip:port format Use the -p parameter to add a proxy Just run Usage Help root@kitploit: .\CVE-2023-23752.exe -h...

CVE-2020-13996

Exploit Title: Joomla J2 Store 3.3.11 - 'filterorderDir' SQL Injection Authenticated Date: 2020-04-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://www.j2store.org/ Software Link: https://www.j2store.org/download.html Reference:...

CF-Hero

CF-Hero CF-Hero What's it? • Features • Background • Installation • Usage • Running cf-hero • ZoomEye Sponsor • To Do What's it? CF-Hero is a comprehensive reconnaissance tool developed to discover the real IP addresses of web applications protected by Cloudflare. It performs multi-source...

aws-iam-authenticator

AWS IAM Authenticator for Kubernetes A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation root@kitploit: pip install...

acltoolkit

acltoolkit acltoolkit es una navaja suiza de abuso de ACL. Implementa múltiples abusos de ACL. Tabla de contenidos acltoolkit Tabla de contenidos Instalación Uso Comandos get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Instalación root@kitploit: pip insta...