CVE-2019-5418

CVE-2019-5418: Ruby on Rails Path Traversal & Arbitrary File Read This project is an environment for practicing and reproducing the local file inclusion vulnerability CVE-2019-5418 in Ruby on Rails. This vulnerability allows reading arbitrary files on the server through path traversal via the...

CVE-2026-36848

CVE-2026-36848 A critical path traversal vulnerability was identified in the web-based management engine on port 8089 of Gigamon-VUE OS GVOS appliances. This flaw exists in the legacy H-VUE subsystem within the persistd daemon and allows an unauthenticated, remote attacker with network access to...

CVE-2019-8942

CVE-2019-8942 and CVE-2019-8943: WordPress RCE author privilege Overview CVE-2019-8942 is a vulnerability that exploits an LFI flaw combined with the File Upload feature to achieve RCE on a WordPress web server with author privileges. Affected WordPress versions include those before 4.9.9 and 5.x...

CVE-2025-55182-poc

CVE-2025-55182 React Flight protocol vulnerability allowing prototype chain traversal via chunk references. Testing against bullshit-react-project. Detection This is slightly out of date as the real PoC has now been revealed. Vite RSC : bash ./vite-detect.sh https://example.com Next.js : bash...

navgix

navgix navgix is a multi-threaded golang tool that will check for nginx alias traversal vulnerabilities Techniques Currently, navgix supports 2 techniques for finding vulnerable directories or location aliases. Those being the following: Heuristics navgix will make an initial GET request to the...

CVE-2018-3760

CVE-2018-3760 Rails Asset Pipeline Directory Traversal Vulnerability Found by Orange Tsai Note : By default, Rails apps running in production mode are not vulnerable to this exploit. Exploit: root@kitploit: curl -v...

CVE-2021-41773-PoC

CVE-2021-41773 Proof of Concept Quick and dirty proof of concept for checking if hosts vulnerable to CVE-2021-41773 root@kitploit: python3 full.py hosts.txt Where hosts.txt contains your targets: root@kitploit: domain.com blah.com 192.168.1.1 It'll print out if the host is vulnerable or not...

CVE-2021-33558

CVE-2021-33558 Reference: https://www.cvedetails.com/cve/CVE-2021-33558 Shodan dork: product:"Boa Web Server" 0.94.13 Payload: root@kitploit: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...

CVE-2024-34313

CVE-2024-34313 Description VPL Jail System up to v4.0.2 was discovered to contain a Path Traversal vulnerability allowing arbitrary file overrides and thereby privilege escalation to root user. This vulnerability can be chained with CVE-2024-34312 to take over a Moodle instance remotely without a...

CVE-2019-8389

CVE-2019-8389 - Arbitrary file read in Musicloud for iOS v1.6 CVE-2019-8389 An exploit code for exploiting a local file read vulnerability in Musicloud v1.6 iOS Application Description: A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the...

CVE-2024-4956

CVE-2024-4956 POC - CVE-2024–4956 - Nexus Repository Manager 3 Unauthenticated Path Traversal Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with Remote Access VPN or Mobile Access Software Blades. A securit...

CVE-2023-35840

CVE-2023-35840 elFinder 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connector Description Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. Vulnerability exists in...

CVE-2006-2842

Badges License MIT Installation Install cve-2006-2842 with npm root@kitploit: npm install cve-2006-2842 -g Usage Example for single url root@kitploit: cve-2006-2842 -u http://example.com Usage Example for list of urls root@kitploit: cve-2006-2842 -l urls.txt -o out.txt Screenshots Help menu Get a...

CVE-2024-37032-PoC

CVE-2024-37032 Probllama PoC — Ollama Path Traversal and Privilege Escalation This repository contains a proof of concept FastAPI registry server, connector script, and preload demo library for authorized lab testing. Use this only on systems you own or are explicitly allowed to test. Files...

grafana-CVE-2021-43798

Grafana CVE Scan 21-43798 0.1 Scanner for Grafana Path Traversal Vulnerability found in CVE-2021-43798 Disclaimer: This is for Educational Purposes only! References for CVE: 1 - NIST CVE Details 2 - Grafana Notes Workarounds All installations between v8.0.0-beta1 and v8.3.0 should be upgraded as...

CVE-2024-24809-Proof-of-concept

Detalle de CVE-2024-24809 Descripción Traccar es un sistema de seguimiento GPS de código abierto. Las versiones anteriores a la 6.0 son vulnerables a path traversal y a la carga sin restricciones de archivos con tipos peligrosos. Dado que el sistema permite el registro por defecto, los atacantes...

CVE-2019-14322

CVE-2019-14322 Modification of faisalfs10x exploit: PoC of CVE-2019-14322: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/ https://nvd.nist.gov/vuln/detail/CVE-2019-14322 Description A vulnerability...

vulnerable-mcp-servers-lab

Vulnerable MCP Servers Lab This repository contains intentionally vulnerable implementations of Model Context Protocol MCP servers both local and remote. Each server lives in its own folder and includes a dedicated README.md with full details on what it does , how to run it , and how to...

CVE-2021-41773_CVE-2021-42013

Apache HTTP Server 2.4.49, 2.4.50 - Path Traversal & RCE Exploit Author: Lucas Souza https://ls4ss.github.io/ Vendor Homepage: https://apache.org/ Version: 2.4.49, 2.4.50 Tested on: 2.4.49, 2.4.50 CVE : CVE-2021-41773, CVE-2021-42013 Credits: Ash Daulton and the cPanel Security Team Usage...

CVE-2021-41773-POC

CVE-2021-41773-POC Documentación del POC y configuración del laboratorio de CVE 2021 41773 ¿Qué es CVE-2021-41773? CVE-2021-41773 es una vulnerabilidad de path traversal en el servidor Apache HTTP 2.4.49 y 2.4.50. Esta vulnerabilidad explota un cambio en el código de normalización de rutas path...