react2shell-burp

React2Shell RCE Scanner and Validator CVE-2025-55182 Creator: j0lt Collaborator: https://github.com/shashank18 A Burp Suite extension that detects and validates the React2Shell vulnerability CVE-2025-55182 — a pre-authentication remote code execution flaw in React Server Components. The extension...

F5-BIG-IP-SmuggleShell-CVE-2023-46747-Exploit

F5 BIG-IP CVE-2023-46747 – RCE sin autenticación + Shell inversa Versiones para Python3 y Nuclei – por raguraman RCE crítica sin autenticación CVSS 9.8 mediante AJP + contrabando de solicitudes HTTP Funciona en todos los BIG-IP sin parche 13.x → 17.x incluyendo el último 17.1.0.3 Parche:...

CVE-2025-1974

Ingress NGINX के लिए एक्सप्लॉइट - IngressNightmare यह प्रोजेक्ट Kubernetes के लिए Ingress NGINX कंट्रोलर में महत्वपूर्ण अनप्रमाणित रिमोट कोड निष्पादन RCE कमजोरियों को लक्षित करने वाला एक एक्सप्लॉइट प्रदान करता है, जिसे सामूहिक रूप से IngressNightmare कहा जाता है। मूल शोध में, Wiz टीम ने कोई PoC य...

CVE-2026-23744

CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthenticated remote code execution PoC for CVE-2026-23744. MCPJam Inspector 1.4.2 and earlier expose functionality through /api/mcp/connect that can launch an attacker-controlled MCP server command without authentication. For authorized...

CVE-2025-34085

Cyberlone Indonesia 🛠️ Escáner de RCE de WordPress Simple File List + Limpieza Automática Herramienta automática para detectar y explotar Remote Code Execution RCE no autenticado en el plugin WordPress Simple File List , especialmente vulnerable a CVE-2025-34085. Equipado con un sistema de limpiez...

CVE-2023-0669-Analysis

CVE-2023-0669 This Repo contain the pcakages and scripts used in this Analysis https://www.vicarius.io/vsociety/blog/unauthenticated-rce-in-goanywhere The vulnerable version of GoAnywhere for Linux https://www.dropbox.com/s/j31l8lgvapbopy3/ga703linuxx64.sh?dl=0...

CVE-2022-46169

CVE 2022-46169 यह स्क्रिप्ट Cacti संस्करण 1.2.22 तक में एक अनप्रमाणित कमांड इंजेक्शन कमजोरी का शोषण करती है ताकि अनप्रमाणित रिमोट कोड निष्पादन प्राप्त किया जा सके और एक रिवर्स शेल प्राप्त किया जा सके।...

CVE-2026-20217

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant reproduction This directory is a standalone, authorized-lab reproduction bundle for the no-account ZendTo-to-ClamAV code-execution chain and its separate default- profile Smarty/root-cron continuation. It includes: the complete runnable Po...

CVE-2026-34486---unauthenticated-RCE-via-Java-deserialization

CVE-2026-34486 EncryptInterceptor fail-open bypass in Apache Tomcat Tribes clustering leading to unauthenticated RCE via Java deserialization. Affected: 11.0.19+, 10.1.53+, 9.0.116+. Fixed in: 11.0.21, 10.1.54, 9.0.117. Found and reported by Bartlomiej Dmitruk striga.ai. Writeup:...

CVE-2025-3248

CVE-2025-3248 Langflow هي منصة منخفضة الترميز تُستخدم بشكل أساسي لبناء ونشر وكلاء الذكاء الاصطناعي وسير العمل. إنها تبسط عملية التطوير من خلال توفير واجهة مرئية لإنشاء تطبيقات ذكاء اصطناعي معقدة، بما في ذلك روبوتات المحادثة، وأنظمة RAG التوليد المعزز بالاسترجاع، والمزيد. إصدارات Langflow السابقة...

CVE-2019-13025

Connect Box CH7465LG CVE-2019-13025 Information This repository contains two PoCs for the Connect Box CH7465LG running on Firmware CH7465LG-NCIP-6.12.18.24-5p8-NOSH or older. For more information have a look at my blog. Usage Unauthenticated Remote Code Execution $ python3 poc-rce.py...

Fortijump-Exploit-CVE-2024-47575

CVE-2024-47575 Fortinet FortiManager Ejecución Remota de Código no Autenticada, también conocido como FortiJump CVE-2024-47575 Consulte nuestra entrada de blog para detalles técnicos Para empezar, establezca su sesión ncat: root@kitploit: nc -lvvnp 80 Luego, ejecute nuestro generador de artefacto...

cve-2025-0364

CVE-2025-0364: BigAntSoft BigAnt Server Account Registration Bypass to File Upload RCE The BigAntSoft BigAnt Server, which provides a Windows hosted on-premises chat server that focuses on business use cases, is vulnerable to unauthenticated remote code execution via account registration and PHP...

CVE-2022-47966-Scan

CVE-2022-47966 Scanner About CVE-2022-47966 is a critical unauthenticated remote code execution vulnerability affecting at least 24 on-premise ManageEngine products. The vulnerability applies only if SAML SSO is enabled. For some products it also applies if SAML SSO was previously enabled. Timeli...

CVE-2022-35405

CVE-2022-35405 मेरी ब्लॉग पोस्ट Nuclei टेम्पलेट अन्य लेख ManageEngine PAM360 और Password Manager Pro बिना प्रमाणीकरण वाली रिमोट कोड निष्पादन भेद्यता PoC Access Manager Plus केवल प्रमाणीकरण के साथ :...

gibbonlms-filewrite_rce

Gibbon LMS Arbitrary File Write / RCE Vulnerability Information Arbitrary File Write in Gibbon LMS for RCE CVE-2023-45878 GibbonEdu Gibbon LMS version 25.0.1 and earlier allows Arbitrary File Write because rubricsvisualisesaveAjax.php does not require authentication. The endpoint accepts the img,...

cve-2026-15748

root@kitploit: CVE-2026-15748 — Forminator Forms Unauthenticated RCE Crafted by Yora For Educational & Authorized Testing Only --- 📌 Deskripsi CVE-2026-15748 merupakan kerentanan yang berkaitan dengan plugin Forminator pada WordPress. Tool ini dibuat untuk membantu security research dan authorize...

CVE-2022-27925-Revshell

Zimbra Exploit de Ejecución Remota de Código No Autenticado CVE-2022-27925 root@kitploit: / / / / / / / / / / / / / // / / / / / / // / / / // / //// // //.// ,/ CVE-2022-27925 usage: exp.py -h -t TARGET -m MASS -l LHOST -p LPORT options: -h, --help show this help message and exit -t TARGET,...

CVE-2022-26134

CVE-2022-26134 On May the 30th, 2022, an organisation named Volexity identified an un-authenticated RCE vulnerability scoring 9.8 on NIST within Atlassian's Confluence Server and Data Center editions Vulnerable Version 7.18.1 Run root@kitploit: python -m venv venv source venv/bin/activate pip...

CVE-2026-33017

CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview CVE-2025-62593 is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine. The root cause is the absence of authentication on critical HTTP endpoints /api/jobs, /api/jobagent/jobs. An attacker can...