13271 matches found
react2shell
React2Shell Herramienta CLI + plantillas de Nuclei para detectar dos vulnerabilidades críticas de RCE en React Server Components y Next.js Server Actions. El escáner fue reescrito basándose en la vulnerabilidad react2shell divulgada. Resumen de vulnerabilidades CVE-2025-55182 – RCE por...
CVE-2025-47812
🚀 Wing FTP Exploit - CVE-2025-47812 Exploit mejorado para Wing FTP Server CVE-2025-47812 - Unauthenticated Remote Code Execution RCE 🔧 Instalación Clona este repositorio y entra en el directorio: root@kitploit: git clone https://github.com/0xjuarez/CVE-2025-47812.git cd CVE-2025-47812 pip install...
CVE-2025-61882-Oracle-BI-Publisher-RCE
Affected Software: Oracle BI Publisher versions 12.2.1.4.0, 12.2.1.3.0. Vulnerability Type: Remote code execution via insecure deserialization in the BI Publisher integration component. Description: The BI Publisher integration component deserializes untrusted data without validation, allowing...
wp2shell
wp2shell Exploit WordPress REST API route confusion CVE-2026-63030 + SQL injection CVE-2026-60137 in the batch endpoint to achieve Remote Code Execution. Vulnerabilities Route Confusion CVE-2026-63030 The WordPress REST API batch endpoint /batch/v1 does not properly isolate request routing. By...
-CVE-2025-59528-PoC
CVE-2025-59528-PoC FOR EDUCATIONAL PURPOSES ONLY A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool, that is also part of an HTB seasonal challenge, on which I tested it btw. If it's not working, make sure the comman...
CVE-2026-3844-Lab
CVE-2026-3844 — Laboratorio de Subida de Archivos Arbitraria No Autenticada a RCE en Breeze Cache Laboratorio Docker local para reproducir y comparar el comportamiento de CVE-2026-3844 en el plugin Breeze Cache de WordPress. Este repositorio demuestra el comportamiento vulnerable en Breeze Cache...
Project-Vuln-Detection-N-Mitigation_101
项目-漏洞检测与缓解101 Apache ActiveMQ 反序列化远程代码执行 CVE-2023-46604 – 第二阶段项目 安全架构与系统管理 作者: Vaishnavu C V · 日期: 2025年9月17日 状态: ⌀ 第二阶段交付物已完成 概述 本仓库记录了一个专注于 Apache ActiveMQ Classic 中 CVE‑2023‑46604 的手动安全设计项目。它包括对漏洞的清晰解释、深入的技术笔记、影响评估、受影响的系统、检测 和 缓解 设计，以及一份适合大学提交的综合设计报告。 快速链接 →→ 第二阶段设计报告（单一文件） →...
CVE-2025-67325
🚨 未认证远程代码执行（RCE）漏洞—文件上传 📌 概述 项目： QloApps 仓库： https://github.com/Qloapps/QloApps 受影响版本： /1.php 找到上传的网页shell !pochttps://assets.kitploit.com/production/publi...
POC-CVE-2025-68613
Description PoC exploit code for N8N authenticated RCE vulnerability CVE-2025-68613 Usage python3 poc.py -u -c...
CVE-2025-64446
POC - CVE-2025-64446 - FortiWeb RCE via Path Traversal + Auth Bypass Overview Fortinet products are some of the most battle-tested appliances protecting enterprise networks today — and ironically, the moment a Forti appliance becomes vulnerable, the blast radius is catastrophic. In late 2025, one...
CVE-2025-32432
CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit for unauthenticated remote code execution in Craft CMS, written in Go. Inspired by the original work of c0gnit00. How it works 1. Gets the PHP session and CSRF token via GET /admin/login 2. Poisons the PHP session file by injecting PHP code into the...
GhostStrike
HEAD Project 2 is LIVE: GhostStrike Fully automated Spring4Shell CVE-2022-22965 + GitLab RCE framework 100% written from scratch • Python • 2025 Features: • Auto listener nc/tmux Modular design spring4shell.py, payloads/ Colorized output + banner Ready for future exploits LFI-to-RCE, Confluence,...
H2-database-CVE-2022-23221
H2 Database RCE CVE-2022-23221 whs41반고늘상@straightSang 1. Resumen Referencia: https://nvd.nist.gov/vuln/detail/cve-2022-23221 H2 es un sistema de gestión de bases de datos relacionales que proporciona la capacidad de compilar y ejecutar código Java directamente dentro del motor SQL. El controlador...
CVE-2026-9198
CVE-2026-9198 - IBM Langflow Unauthenticated RCE via Auto-Login Bypass Educational PoC This repository provides an educational proof of concept for CVE-2026-9198 affecting IBM Langflow OSS. The PoC poc.py demonstrates how an unauthenticated attacker can chain: 1. GET/POST /api/v1/autologin return...
CVE-2026-60137_CVE-2026-63030
CVE-2026-60137 + CVE-2026-63030 — WordPress 未认证远程代码执行（RCE） 漏洞类型： REST 批处理路由混淆 + WPQuery SQL 注入 → 完整 RCE CVSS v3.1： 10.0 / 10.0 — 严重 | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H 受影响版本： WordPress 6.9.0–6.9.4, 7.0.0–7.0.1 | 已修复版本： 6.9.5, 7.0.2 Zero credentials → Route Confusion → SQLi → Admin → Shell Uploa...
CVE-2025-14700-poc
PoC de CVE-2025-14700 Exploit automático para RCE autenticado en Crafty Controller --login --password --lhost --lport Este script utiliza netcat para configurar un listener después de activar la carga útil de reverse shell, no funcionará si no tienes netcat en tu máquina listener...
cve-2025-24893
CVE-2025-24893 - XWiki Unauthenticated RCE Exploit POC ⚠️ Unauthenticated Remote Code Execution in XWiki 🛠️ PoC implementation by @dollarboysushil 💡 Overview CVE-2025-24893 is a critical RCE vulnerability in XWiki, caused by unsafe Groovy expression handling inside the SolrSearch macro. An attacker...
CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX
FreePBX CVE-2025 Escáner de Vulnerabilidades ⚠️ DESCARGO DE RESPONSABILIDAD SOLO PARA PRUEBAS EDUCATIVAS Y AUTORIZADAS Esta herramienta se proporciona "TAL CUAL" solo con fines educativos y de investigación Los autores NO son responsables por cualquier uso indebido o actividades ilegales El acceso...
watchTowr-vs-JunosEvolved-CVE-2026-21902
watchTowr-vs-JunosEvolved-CVE-2026-21902 Detection Artifact Generator for Juniper Junos Evolved CVE-2026-21902. https://github.com/user-attachments/assets/a7d667e1-7636-4097-ab3f-838944cdcccc See our blog post for technical details. Detection in Action root@kitploit: python...
