CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE The RCE is obtained by abusing 2 vulnerabilities CVE-2026-55494 CVE-2026-62308 In short, a SSRF vulnerability is abused to call to an unauthenticated service in the internal network to create a docker that shares the same pid with tugtainer, thus making the file system of th...

CVE-2026-54390

CVE-2026-54390 — JTL Shop Smarty SSTI Mass Exploit Pre-Auth Contact Form → Email Subject → fetch'string:' → RCE Overview CVE-2026-54390 is a critical CVSS 9.8 unauthenticated Server-Side Template Injection in JTL Shop 5.2.0–5.7.1. The SmartyRenderer::renderTemplate method passes email subject lin...

FortiWeb-cve-2025-64446-RCE-exploit

FortiWeb CVE-2025-64446 RCE Exploit Professional security research & vulnerability assessment framework Installation · Quick Start · Usage · Architecture · CLI Reference · Disclaimer Overview FortiWeb Research Tool is a Python assessment framework for authorized detection and analysis of...

vulhub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. 中文版本Chinese version Quick Start Install Docker examp...

metabase-cve-2023-38646

cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Metabase Pre-Auth Remote Code Execution Summary CVSS 9.8. Metabase versions before 0.46.6.1 / 1.46.6.1 and equivalent earlier branches expose a pre-authentication RCE via the /api/setup/validate endpoint, which is meant to validate database...

wp2shell

wp2shell Pre-authentication Remote Code Execution against WordPress Core. Chains CVE-2026-60137 SQLi in authornotin / authorexclude parameter of WPQuery with CVE-2026-63030 REST API batch-route confusion for unauthenticated RCE. Affected Versions...

CVE-2020-2551

Twitter: @Hktalent3135773 0、how get pro exploit tools? see https://github.com/hktalent/CVE-2020-2551/issues/5 1、CVE-2020-2551 CVE-2020-2551 poc exploit python example keys: GIOP corba How use root@kitploit: python3 CVE-2020-2551.py -u http://192.168.26.79:7001 cat urls.txt|sort -u|xargs -I %...

CVE-2025-11001---7-Zip

CVE-2025-11001 - 7-Zip High-severity symlink traversal in 7-Zip allowing arbitrary file write / RCE Patched in 7-Zip 25.00 July 2025 – Public exploit available FOR AUTHORIZED SECURITY TESTING AND RESEARCH ONLY -critical Vulnerability Summary CVE : CVE-2025-11001 CVSS v3.1 : 7.0 High –...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.72 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

CVE-2026-40860

camel-jms JMS ObjectMessage Unsafe Deserialization Reproducer CVE-2026-40860 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-jms component and, transitively, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6, tracked as CVE-2026-40860...

CVE-2026-40453

Case-Variant Camel Header Injection Reproducer CVE-2026-40453 This project demonstrates CVE-2026-40453 — an incomplete fix for CVE-2025-27636. The 2025 fix added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names e.g. CAmelExecCommandExecutable are filtered alongside t...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE /terminal/ws root@kitploit: CVSS 4.0 : 9.3 CRITICAL CVSS 3.x : 9.8 CRITICAL CWE : CWE-306 Missing Authentication for Critical Function Fix : Marimo 0.23.0+ Affects : Marimo Lab / authorized testing only HTB, CTF, engagement with written scope. Table of content...

CVE-2025-32432

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit for unauthenticated remote code execution in Craft CMS, written in Go. Inspired by the original work of c0gnit00. How it works 1. Gets the PHP session and CSRF token via GET /admin/login 2. Poisons the PHP session file by injecting PHP code into the...

CVE-2025-55182

CVE-2025-55182 A command-line tool for detecting CVE-2025-55182 and CVE-2025-66478 in Next.js applications using React Server Components. 🚀 Installation root@kitploit: wget -q -O /usr/bin/CVE-2025-55182 https://raw.githubusercontent.com/rix4uni/CVE-2025-55182/refs/heads/main/CVE-2025-55182 && chm...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors White Hat School 4th Cohort, Class 25 임두연@endusdksla Summary XWiki interprets wiki syntax and macros on the server side and renders them. The issue is that the Main.SolrSearch page is open to guests, yet it evaluates the user input...

CVE-2022-3602

Detection for CVE-2022-3602 - OpenSSL RCE/DOC v3.0.0 - v3.0.6 Detects when the HTTP Server header indicates that the version of OpenSSL is vulnerable to CVE-2022-3602 ie. v3.0.0 to v3.0.6 inclusive. Detects exploitation attempts in TLS v1.2. References:...

thinkphp5.XRce

ThinkPHP5.0 Vulnerability Detection Script Rewritten based on @tdcoming's script Introduction: Affected versions: v5.1.x 5.1.31 v5.0.x = 5.0.23 Usage: 1. pip install -r requirements.txt 2. Create url.txt in the script directory 3. Put the URLs to be tested into it 4. Run the script Screenshot:...

CVE-2025-32432

CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Authentication Remote Code Execution in Craft CMS Affected: Craft CMS 3.x, 4.x, and 5.x up to 5.6.16 Info: This exploit is tested against HackTheBox Orion machine Overview This repository contains a proof-of-concept exploit for CVE-2025-32432...

Log4jShell-Scan

Overview log4j2 RCE vulnerability CVE-2021-44228 intranet scanner, can be used for vulnerability scanning under the condition of no internet access, helping enterprises quickly discover Log4Shell vulnerabilities. Modified from: https://github.com/fullhunt/log4j-scan JNDIMonitor from:...