CVE-2026-13001

CVE-2026-13001 Podlove Podcast Publisher CVSS 9.8 Critical | Unauthenticated Arbitrary File Upload leading to Remote Code Execution Overview Critical vulnerability in the Podlove Podcast Publisher WordPress plugin versions up to and including 4.5.1 that allows unauthenticated attackers to upload...

CVE-2026-25938-FUXA-Unauthenticated-RCE

CVE-2026-25938 - FUXA Unauthenticated RCE 1. What is FUXA? FUXA is a free, open-source, web-based SCADA Supervisory Control and Data Acquisition and HMI Human-Machine Interface platform used for industrial automation , IoT , and real-time process visualization. It lets users build custom...

CVE-2024-4885

CVE-2024-4885 PoC para CVE-2024-4885 Progress WhatsUp Gold GetFileWithoutZip Remote Code Execution No Autenticado CVE-2024-4885 Análisis Técnico Se puede encontrar un análisis de causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/progress-whatsup-gold-rce-cve-2024-4885/ Uso...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Vulnerabilidad de ejecución remota de código no autenticada en Wing FTP Server = 7.4.3. Un byte NULL inyectado en el parámetro username durante el inicio de sesión provoca que se escriba código Lua en el archivo de sesión. Cuando se accede a /dir.html con la cooki...

CVE-2019-9978

CVE-2019-9978 CVE-2019-9978 - PoC RCE in Social WarFare Plugin system'cat /etc/passwd' Guárdalo con el nombre: payload.txt y súbelo a un servidor. La URI debería verse así: https://yoursite.com/payload.txt. Finalmente, proporciona tus opciones --target y --payload-uri: root@kitploit: $ python...

CVE-2025-71389_exploit

CVE-2025-71389 — Cal.com Unauthenticated RCE react2shell Unauthenticated remote code execution in Cal.com = 5.9.8 via the React Server Components "Flight" deserialization flaw — "react2shell " CVE-2025-55182 in React, CVE-2025-66478 in Next.js. Cal.com bundles a vulnerable Next.js 15.x. A single...

CVE-2025-3248-Langflow-RCE

CVE-2025-3248 — Exécution de code à distance non authentifiée dans Langflow Preuve de concept d'exploitation pour CVE-2025-3248 , une vulnérabilité d'exécution de code à distance non authentifiée dans Langflow, une plateforme de création de flux de travail pour l'IA et les LLM. Versions concernée...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE Proof-of-concept exploit for CVE-2026-48908 , a critical CVSS 4.0 = 10.0 unauthenticated remote-code-execution vulnerability in the SP Page Builder component comsppagebuilder for Joomla, by JoomShaper...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Prueba de Concepto PoC Simplemente accede a la URL con tu código PHP en el parámetro "gridValoresPopHidden"...

CVE-2025-34085-Multi-target

CVE-2025-34085 Escáner RCE Multiobjetivo Escáner de explotación masiva para CVE-2025-34085 — una vulnerabilidad de ejecución remota de código no autenticada en el plugin Simple File List de WordPress. Esta herramienta sube un payload PHP disfrazado como imagen, lo renombra mediante un motor de...

CVE-2020-14882

CVE-2020-14882 desplegando un memory shell de Behinder Como es bien sabido, CVE-2020-14882 es una vulnerabilidad no autenticada que permite a un atacante ejecutar código arbitrario en el WebLogic Server afectado. En los PoC públicos, el acceso se logra mediante la omisión de caracteres ilegales y...

CVE-2025-55182

CVE-2025-55182 — React2Shell Pre-authentication Remote Code Execution in React Server Components RSC, Next.js, and related frameworks. Overview CVE-2025-55182 also referred to as React2Shell is a critical pre-authentication RCE vulnerability affecting the React Server Components RSC ecosystem. An...

CVE-2023-20887

CVE-2023-20887 POC para CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight RCE no autenticado Análisis Técnico Se puede encontrar un análisis de causa raíz de la vulnerabilidad en mi blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/...

CVE-2021-21972

CVE-2021-21972 Prueba de Concepto de Exploit para vCenter CVE-2021-21972 Crédito de investigación a: https://swarm.ptsecurity.com/unauth-rce-vmware/, http://noahblog.360.cn/vcenter-6-5-7-0-rce-lou-dong-fen-xi/ Probado en objetivos vCenter VCSA tanto en Windows como en Unix. Uso Para comprobar de...

CVE-2024-4883

CVE-2024-4883 PoC for CVE-2024-4883 Progress WhatsUp Gold WriteDatafile Unauthenticated Remote Code Execution CVE-2024-4883 Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/progress-whatsup-gold-WriteDataFile-CVE-2024-4883-RCE/ Usa...

CVE-2020-14882-weblogicRCE

Detección de RCE en el "WebLogic Server" de Oracle CVE-2020-14882 / CVE-2020-14750 Resumen: Detección de intentos de explotar CVE-2020-14882 y CVE-2020-14750: RCE no autenticado en el servidor WebLogic de Oracle. Referencias: Avisos de Oracle: CVE-2020-14882...

CVE-2023-26035

CVE-2023-26035 Unauthenticated RCE in ZoneMinder Snapshots - PoC Exploit alt img Description ZoneMinder versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution due to missing authorization checks in the snapshot action. Usage root@kitploit: git clone...

CVE-2019-15107

CVE-2019-15107 Webmin RCE Error - Perl execution Failed Your password has expired, and a new one must be chosen.uid=0root gid=0root groups=0root PoC Failed to change password : The curren...

CVE-2022-46169

Exploit CVE-2022-46169 Exploit para la vulnerabilidad CVE-2022-46169 en Cacti 1.2.19 Opciones root@kitploit: -u --url victim's url -f --forwarded X-Forwarded value to bypass the auth -m --mode: check for Checking for Vulnerable Servers, or exploit for Fun exploitation mode :D Uso root@kitploit: 1...

CVE-2026-82923 AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...