CVE-2022-41924

CVE-2022-41924 POC 👉 https://oalieno.tw/posts/tailscale-rce...

PoC-for-CVE-2020-28948-CVE-2020-28949

POC for CVE-2020-28948 & CVE-2020-28949 The files here contain PoC for CVE-2020-28948 & CVE-2020-28949 to achieve remote exploit The server The server folder contains a simple upload server which uses the vulnerable ArchiveTar library, located in server/Archive. The server accepts a Tar archive...

CVE-2025-25257

CVE-2025-25257 FortiWeb CVE-2025-25257 exploit https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce exp.py: working/full exploit. signed.py: just a PoC of file read/write. initial version of the exploit...

Zimbra-RCE

Zimbra-RCE Zimbra RCE CVE-2019-9670 root@kitploit: $ ./zimbra.py -h . . \ /|| \ | \ \ \ / / / | |/ | \ \ \ | / \ / | / / | | Y Y \ \ \ | // \ | | \ | \ / |||| / /| / || /\ / / / / / / / / / usage: zimbra.py -h -u URL -d DTD -n PAYLOADNAME -f PAYLOADFILE Zimbra RCE CVE-2019-9670...

CVE-2018-14324-Exploit

Hacking Eclipse GlassFish - CVE-2018-14324 The description of CVE-2018-14324 does not fully explain the impact of this vulnerability. TLDR you have access to Java Management Extensions JMX via hardcoded admin:admin creds. While impact is listed as " potentially sensitive information, perform...

CVE-2026-33017-Exploit

Fireflow RCE Exploit Remote Code Execution for Langflow via the buildpublictmp endpoint. Exploit via Public Flow Build Endpoint that executes a reverse shell on the target. Requirements Python 3.8+ httpx library Install: root@kitploit: pip install httpx Usage root@kitploit: python exploit.py -u -...

CVE-2024-40110

Poultry Farm Management System v1.0 - RCE Exploit Vulnerability Type Unauthenticated File Upload with Remote Code Execution Description The Poultry Farm Management System v1.0 contains a critical vulnerability in the product upload functionality. The application fails to properly validate and...

CVE-2025-1974

DEMO https://youtu.be/3hYlHeaf2mQ What is CVE-2025-1974? CVE-2025-1974 IngressNightmare is a critical CVSS 9.8 unauthenticated Remote Code Execution vulnerability in the Kubernetes ingress-nginx admission controller. Attack Flow: 1. Upload : Send malicious shared library .so file to NGINX via HTT...

CVE-2022-22963

CVE-2022-22963 CVE-2022-22963 PoC Slight modified for English translation and detection of https://github.com/chaosec2021/Spring-cloud-function-SpEL-RCE/blob/main/SpelRCEPOC.py . By default whoami is executed on the target and a file vulnerable.txt is created with the URLs that are vulnerable...

CVE-2019-7238

CVE-2019-7238 RCE python3 CVE-2019-7238.py url...

CVE-2019-3396

CVE-2019-3396 Confluence Widget Connector path traversal CVE-2019-3396 RCE POC root@kitploit: POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0...

cve-2022-42889-text4shell

Install maven - maven-linux 1. Maven install to create the fat jar root@kitploit: mvn clean install 2. Docker build root@kitploit: docker build --tag=text4shell . 3. Docker run root@kitploit: docker run -p 80:8080 text4shell 4. Test the app root@kitploit: http://localhost/text4shell/attack?search...

CVE-2025-55182

CVE-2025-55182 Next.js Prototype Pollution CVE-2025-55182 is a critical prototype pollution vulnerability in nextjs that allows rce via improper input sanitization in the framework's request handling mechanism, this whole thing happens because nextjs is out here trusting JSON objects like a...

CVE-2026-100739

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2025-55182

CVE-2025-55182 - React2Shell A modified and boosted exploit for CVE-2025-55182 a pre-authentication Remote Code Execution in React Server version 19.0, 19.1.0, 19.1.1, and 19.2.0 The vulnerability spans the following: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack Pat...

cve-2024-1708-connectwise_rce_reproduction

CVE-2024-1708 / CVE-2024-1709 — ConnectWise ScreenConnect Authentication Bypass & Remote Code Execution CVSS Score: 8.4 CVE-2024-1708 – 10.0 CVE-2024-1709 CWE: CWE-22 Path Traversal, CWE-288 Authentication Bypass Using an Alternate Path Affected Software: ConnectWise ScreenConnect formerly...

CVE-2024-51793

CVE-2024-51793 Exploit Tool Documentation 📋 Overview CVE-2024-51793 is an unauthenticated arbitrary file upload vulnerability in the Computer Repair Shop WordPress plugin versions prior to 3.8116. This vulnerability allows attackers to upload arbitrary files, including PHP webshells, without...

w3-total-cache-cve-2013-2010

w3-total-cache-cve-2013-2010 Remote code execution running on w3 total cache cve 2013-2010 Usage: python3 w3tcrceexploit.py -u http://example.com -p "system'whoami';" Output: Targeting: http://example.com + Payload sent successfully. + Check the target for execution of the payload. import request...

CVE-2021-21974

CVE-2021-21974 PoC - VMware ESXi RCE Exploit Description This repository contains a Proof of Concept PoC for the vulnerability CVE-2021-21974 , a remote code execution RCE vulnerability in the OpenSLP service of VMware ESXi. Successful exploitation could allow an unauthenticated attacker to execu...

CVE-2022-22965

CVE-2022-22965 Spring4Shell-PoC Version Spring Framework 5.2.20 and 5.3.18 Patched version: Spring Framework 5.3.18 and 5.2.20 Spring Boot 2.6.6 and 2.5.12 Details Spring Core is the core component of Spring Framework. This is the foundation to build other components in the Spring Framework...