CVE-2026-44024_exploit

CVE-2026-44024 — Fluentd outfile $tag Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Fluentd's outfile plugin via the $tag placeholder. outfile lets operators template the output path with a $tag placeholder e.g. path /var/log/fluent/$tag. Outputextractplaceholders...

POC_CVE-2024-12537

CVE-2024-12537 Open WebUI Code Format DoS Lab This repository contains a local, isolated reproduction lab and nuclei template candidate for CVE-2024-12537, an unauthenticated denial-of-service vulnerability in Open WebUI's code formatting endpoint. The lab does not send large denial-of-service...

CVE-2023-27372-SPIP-4.2.1-Unauthenticated-RCE-PoC

CVE-2023-27372 — SPIP Unauthenticated remote code execution vulnerability in SPIP before 4.2.1. The oubli parameter in the password reset form is vulnerable to PHP object injection due to mishandled deserialization. A crafted serialized payload is executed server-side as the web user, and the...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...

CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise

Flowise Password Reset Account Takeover ATO For research and testing purposes only! I am not responsible for any damages to live infrastructure if this tool is not used as intended. Only use on systems you own or have permission to be testing! Usage root@kitploit: usage:...

CVE-2025-56399

CVE-2025-56399 大量エクスプロイト CVE-2025-56399 – laravel-file-manager v3.3.1 におけるリモートコード実行。Laravel File Manager の設定ミスを悪用し、認証不要のファイルアップロードを介して PHP シェルをアップロード・検証します。 インストール リポジトリをダウンロード root@kitploit: git clone https://github.com/im-hanzou/CVE-2025-56399 リポジトリフォルダに移動 root@kitploit: cd CVE-2025-56399...

CVE-2025-55182

CVE-2025-55182 — React2Shell: Advanced Exploit & Master's Thesis Research -brightred Deserialization of Untrusted Data + Prototype Pollution in React Server Components Unauthenticated Remote Code Execution via Next.js Server Actions Affected: React 19.0.0 - 19.2.0 · Patch: React 19.0.1 / 19.1.2 /...

PoC-CVE-2026-33017

PoC: CVE-2026-33017 Langflow = 1.8.1 is vulnerable to a remote, unauthenticated RCE https://nvd.nist.gov/vuln/detail/CVE-2026-33017 Usage root@kitploit: usage: CVE-2026-33017.py -h --lhost LHOST --lport LPORT target PoC exploit: CVE-2026-33017 positional arguments: target Target hostname options:...

CVE-2026-0300-POC

🛡️ CVE-2026-0300: PAN-OS User-ID™ Portal RCE Analysis Research Proof-of-Concept: CWE-787 Out-of-bounds Write 📌 Overview CVE-2026-0300 is a high-severity buffer overflow vulnerability identified in the Palo Alto Networks PAN-OS User-ID™ Authentication Portal Captive Portal. This research repository...

SharePoint-ToolShell-CVE-2025-53770-Incident-Analysis

SharePoint ToolShell CVE-2025-53770 Incident Analysis Overview This project documents the investigation of a real-world exploitation attempt targeting a SharePoint server using the ToolShell vulnerability CVE-2025-53770. The attack demonstrates a full exploitation chain including remote code...

CVE-2026-1107

CVE-2026-1107 Nuclei Template Nuclei template for detecting CVE-2026-1107 in EyouCMS. The vulnerability allows unauthenticated attackers to perform Path Traversal/Arbitrary File Read via the checkuserinfo function in Diyajax.php. Vulnerability Details CVE ID: CVE-2026-1107 Target: EyouCMS 1.7.1...

CVE-2025-2563

CVE-2025-2563 — User Registration & Membership | Full-Chain Admin Escalation root@kitploit: ██╗ ██╗███████╗███████╗██████╗ ██████╗ ███████╗ ██████╗ ██║ ██║██╔════╝██╔════╝██╔══██╗ ██╔══██╗██╔════╝██╔════╝ ██║ ██║███████╗█████╗ ██████╔╝ ██████╔╝█████╗ ██║ ███╗ ██║ ██║╚════██║██╔══╝ ██╔══██╗...

CVE-2025-5880-PoC

CVE-2025-5880 — Whistle 2.9.98 Path Traversal PoC Proof-of-concept exploit for an unauthenticated path traversal vulnerability in Whistle v2.9.98. Vulnerability Summary...

CVE-2026-22812

🔐 CVE-2026-22812 - OpenCode Unauthenticated HTTP Server → Remote Code Execution RCE Security advisory, technical analysis, detection guidance, and mitigation notes for CVE-2026-22812 📌 Overview CVE-2026-22812 is a high-severity Remote Code Execution RCE vulnerability affecting OpenCode versions...

CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” A critical unauthenticated remote code execution vulnerability in an open-source workflow automation platform. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Impact Exploitation Detection Remediation Mitigation Summary 🔎 Overview...

CVE-2026-4106

CVE-2026-4106: WordPress HT Mega Unauthenticated PII Disclosure Exploit A robust, multi-threaded Proof of Concept PoC exploit for CVE-2026-4106 , targeting the HT Mega - Absolute Addons for Elementor plugin for WordPress versions 3.0.7. Vulnerability Overview The HT Mega plugin registers several...

CVE-2026-28289

🚨 CVE-2026-28289 — “Mail2Shell” Zero-Click Unauthenticated RCE in FreeScout via Email Attachment Bypass 📖 Overview CVE-2026-28289 , nicknamed Mail2Shell , is a critical zero-click Remote Code Execution RCE vulnerability affecting FreeScout. An attacker can send a specially crafted email to a...

cve-2025-59287-exploit-poc

CVE-2025-59287 概念実証エクスプロイト 脆弱性の概要 CVE-2025-59287 は、Microsoft Windows Server Update Services WSUS における重大なリモートコード実行 RCE 脆弱性です。この脆弱性は、EncryptionHelper.DecryptData メソッド内の BinaryFormatter による AuthorizationCookie データの安全でない逆シリアル化が原因で発生します。 影響 : 認証されていない攻撃者が、悪意のある暗号化クッキーを GetCookie エンドポイントに送信することで、SYSTEM...

Linux Distros Unpatched Vulnerability : CVE-2026-66835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixin...

PT-2026-85206

A critical WHMCS security update fixes CVE-2026-67399 and CVE-2026-67398. Apply the patch now to prevent remote code execution and data leaks. WHMCS CyberSecurity CVE202667399 CVE202667398 InfoSec https://t.co/LuCYwv3icN https://t.co/BNvTvGIUBc...