992540 matches found
CVE-2025-55182-Simple-Scanner
CVE-2025-55182: React Server Components RCE Scanner A comprehensive toolkit for detecting and exploiting CVE-2025-55182 , a Critical Remote Code Execution vulnerability in Next.js applications using React Server Components. This repository features a unified Bash scanner Single & Mass mode,...
CVE-2019-0708-EXP-MSF-
CVE-2019-0708-EXP-MSF- CVE-2019-0708-EXPMSF Vulnerability exploit program for cve-2019-0708 要求msf版本在5.0.4以上 root@kitploit: mkdir -p /usr/share/metasploit-framework/modules/exploit/windows/rdp/ mkdir -p /usr/share/metasploit-framework/modules/auxiliary/scanner/rdp/ mkdir -p...
CVE-2025-7441
CVE-2025-7441 StoryChief data - sizes - full يشير إلى عنوان URL تعسفي. لا يقوم StoryChief بتحقق كافٍ من نوع/محتوى الملف ولا يقيّد مصدر العنوان، مما يسمح للإضافة بجلب المورد البعيد وحفظه في دليل uploads الخاص بالموقع. لا يوجد تحقق كافٍ لمنع تخزين ملفات تحتوي على أكواد قابلة للتنفيذ. 🛠️ سكربت...
CVE-2024-24401
تقرير الثغرة اكتشاف CVE مصمم للعمل على KALI LINUX ملاحظات قامت Nagios بتصحيح الإصدار 2024R1.0.1 في جميع التنزيلات الحديثة. لتحديد ما إذا كان الهدف معرضًا للثغرة، تأكد من أنهم يستخدمون تنزيلًا أقدم من 2024R1.0.1. يتحقق السكربت المحدَّث من أن النظام المستهدف معرّض للثغرة تفاصيل الثغرة: الوصلة:...
CVE-2024-51378
CVE-2024-51378 — Summary, Mitigation, and Documentation Safe Repository ⚠️ Ethical & legal warning All materials in this repository are for educational purposes, legitimate security research, and testing on environments you own or have explicit permission. Do not run these tools or scripts against...
POC_CVE-2025-14700
CVE-2025-14700 PoC for CVE-2025-14700 , a Server-Side Template Injection SSTI vulnerability in Crafty Controller = 4.6.1. This vulnerability allows authenticated users to achieve Remote Code Execution RCE by injecting malicious Jinja2 templates into the Webhook configuration. 📦 Installation...
CVE-2023-51385_test
Verify CVE-2023-51385 First, add the following to /.ssh/config root@kitploit: 主机 .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/bar After...
CVE-2024-11635
WordPress File Upload यह README केवल शैक्षिक और रक्षात्मक उपयोग के लिए एक प्रकट भेद्यता का दस्तावेजीकरण करता है। उत्पादन प्रणालियों या उन प्रणालियों पर परीक्षणनहीं चलाएँ जिनके आप स्वामी नहीं हैं या जिनके परीक्षण की आपको स्पष्ट अनुमति नहीं है। खोजकर्ता: abrahack स्थिति: सार्वजनिक प्रकटीकरण रिपोर्ट...
CVE-2023-34040
CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...
CVE-2026-25512
CVE-2026-25512: تنفيذ التعليمات البرمجية عن بُعد عبر حقن الأوامر في معالج TNEF - Group-Office متجه CVSS 4.0 : CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H جدول المحتويات الملخص الإصدارات المتأثرة التفاصيل الفنية السبب الجذري مسار من المصدر إلى نقطة الاستغلال الاستغلال الاستغلال...
CVE-2019-2618
PoC root@kitploit: POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux i686; rv:20.0 Gecko/20100101 Firefox/20.0 Accept: text/html, image/gif, image/jpeg, /; q=.2 Connection: keep-alive username: weblogic password: weblogic...
CVE-2016-3238-PoC
CVE-2016-3238-PoC Whitepaper for CVE-2016-3238/MS16-087 Proof Of concept. CVE-2016-3238 allows man-in-the-middle attackers to execute arbitrary code by providing a crafted print driver during printer installation, aka "Windows Print Spooler Remote Code Execution Vulnerability."...
EUVD-2026-69650
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2026-71981
Cypht versions before 2.12.2 contain a PHP object injection vulnerability in the logout handler. The back_query GET parameter accepts a base64-encoded serialized payload that is passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exp...
CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2026-71981 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
CVE-2025-55182
CVE-2025-55182 Toolkit & Lab Educational Only Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182. For educational and authorized testing only. Features Root-cause writeup, visuals, and lab: see React2ShellDeconstructingaPerfect10RCE.pdf and the attack-path...
Online-Admission-System-RCE-PoC
This repository does not have a README...
CVE-2018-3245
CVE-2018-3245 Step 1 java -jar ysoserial-cve-2018-3245.jar root@kitploit: Usage: java -jar ysoserial-cve-2018-3245.jar payload 'command' Available payload types: Payload Authors Dependencies ------- ------- ------------ CVE201828931 @mbechler CVE201828932 @mbechler CVE201828933 @mbechler...