152014 matches found
CVE-2024-29272
CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: root@kitploit: nc -lvnp...
CVE-2022-37932
HP Switch Firmware Authentication Bypass Vulnerability CVE-2022-37932 Firmware Version: PD.02.21 Affected Devices: HP 1920 Series Smart Managed Switches Overview This repository documents a critical authentication bypass vulnerability in HP 1920 Series Smart Managed Switches running firmware...
CVE-2022-26134
Confluence Pre-Auth Remote Code Execution via OGNL Injection CVE-2022-26134 Confluence Pre-Auth Remote Code Execution via OGNL Injection CVE-2022-26134 On June 02, 2022 Atlassian released a security advisory for their Confluence Server and Data Center applications, highlighting a critical severit...
CVE-2021-41773
HTTP Apache Path Traversal NSE Script CVE-2021-41773 Description This NSE script checks if an Apache HTTP Server is vulnerable to the Path Traversal vulnerability CVE-2021-41773. A vulnerable server allows attackers to access files they shouldn't, without logging in. How It Works : 1. Script Star...
CVE-2021-21234
CVE-2021-21234 Directory traversal vulnerability in the spring-boot-actuator-logview library https://blogg.pwc.no/styringogkontroll/unauthenticated-directory-traversal-vulnerability-in-a-java-spring-boot-actuator-library-cve-2021-21234...
Blackash-CVE-2025-4322
CVE-2025-4322 : Unauthenticated Privilege Escalation via Password Update "Account Takeover 🔥" Description : The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a...
CVE-2024-21182
CVE-2024-21182 — Oracle WebLogic Server T3/IIOP JNDI Injection → RCE lab A self-contained, one-command Docker lab to reproduce and validate the Oracle WebLogic Server OpaqueReference JNDI-injection vulnerability family CVE-2024-21182, a patch bypass of CVE-2023-21839 and turn it into...
CVE-2021-25094-tatsu-preauth-rce
Preauth RCE in Tatsu builder Wordpress plugin CVE-2021-25094 Simple PoC of an unauthenticated RCE in Tatsu Builder = 3.3.11 provided as an example. Full write-up here: https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/ Usage: root@kitploit: python3 exploit-rce.py -h...
confluence-ognl-rce
CVE-2022-26134 - Atlassian Confluence OGNL RCE This script is a wrapper over an unauthenticated remote code execution via OGNL injection exploit primitive in Confluence Data Center and Server CVE-2022-26314. Vendor advisory Originally inspired by the PoC jbaines-r7/throughthewire. I added the...
CVE-2024-48326
CVE-2024-48326 Description: Portabilis i-Educar v2.8.0 is vulnerable to Cross-Site Scripting XSS via the nmreligiao parameter in POST request at /intranet/educarreligiaocad.php and trigged in GET request at /intranet/educarreligiaolst.php?busca=S&nmreligiao=. This allows an unauthenticated remote...
exploit-react-CVE-2025-55182
FOX-RSC TOOL CVE-2025-55182 & CVE-2025-66478 LEGAL DISCLAIMER EN: This tool is a Proof of Concept PoC intended for security research and educational purposes only. Using this tool on systems without explicit permission is illegal and punishable by law. The author Tiger-Foxx assumes no...
CVE-2023-1671-POC
Dork fofa title="Sophos Web Appliance" || app="Sophos-Web-Appliance" && title!="Sophos Web Appliance：错误请求" ZoomEye title:"Sophos Web Appliance"-title:"Sophos Web Appliance: Forbidden"-title:"Sophos Web Appliance: Bad Request" Shodan title:"Sophos Web Appliance" Usage root@kitploit: python...
exploit-CVE-2023-27564
Exploit for CVE-2023-27564 This vulnerability allows anonymous file read in n8n. root@kitploit: import requests url = "https://example.com/rest/data/filesystem:..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd:.svg" response = requests.geturl printresponse.statuscode printresponse.headers...
Oracle-WebLogic-CVE-2022-21371
Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Local File Inclusion : CVE-2022-21371 Affected Version: Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 Description: The Oracle Fusion Middleware's Oracle WebLogic Server product Web Container component is vulnerable to local file...
VMware_vCenter_UNAuthorized_RCE_CVE-2021-21972
VMwarevCenterUNAuthorizedRCECVE-2021-21972 zoomeye dork: app:"VMware vCenter" A harmless detection script written using pocsuite3 VMwarevCenterUNAuthorizedRCE.py, using nearly a year of data for detection: Success rate approximately: 1551 / 3998 = 39%...
CVE-2024-10793
CVE-2024-10793 CVE-2024-10793 poc exploit CVE-2024-10793.yaml script is needed to search for a plugin. CVE-2024-10793.sh script is the exploit itself. For post-exploitation, you can use beef-xss. Google dork: inurl:wp-content/plugins/wp-security-audit-log The WP Activity Log plugin for WordPress ...
CVE-2024-21006_PoC
CVE-2024-21006 PoC CVE-2024-21006 is a critical Remote Code Execution RCE vulnerability affecting Oracle WebLogic Server. The flaw is related to the insecure use of the IIOP Internet Inter-ORB Protocol and JNDI Java Naming and Directory Interface protocols, allowing an unauthenticated remote...
CVE-2024-9796
CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5×tamp=13672261755853'...
doublepulsar-detection-script
Author: Luke Jennings [email protected] - @jukelennings Company: Countercept @countercept Website: https://countercept.com A set of python2 scripts for sweeping a list of IPs for the presence of both SMB and RDP versions of the DOUBLEPULSAR implant that was released by the Shadow Brokers...
PoC-Funcional---CVE-2026-45247-Mirasvit-Full-Page-Cache-Warmer-RCE-
CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 - PHP Object Injection → RCE -red 📋 Description CVE-2026-45247 is a critical PHP Object Injection vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce. An unauthenticated attacker can achieve...