CVE-2023-30258-magnus-billing-v7-exploit

Magnus Billing System v7 Exploit This Python script automates the exploitation of a command injection vulnerability in Magnus Billing System v7, specifically in the icepay.php script located at /mbilling/lib/icepay/icepay.php. The exploit leverages the democ parameter to execute arbitrary command...

CVE-2026-11551-PoC

CVE-2026-11551 - Unauthenticated Privilege in White Label & Branding, Free Login Page Customizer White Label & Branding, Free Login Page Customizer update $wpdb-users, $data, ... ← Line 2515: DOUBLE HASH TERSIMPAN Kode yang Vulnerable inc/modules/login-screen/signup-password.php:230-251 ro...

CVE-2021-42013

CVE-2021-42013 Colaborador 석은호@eunho87 CVE-2021-42013 Apache http Server Path Traversal Resumen de la vulnerabilidad Un error en el manejo de la normalización de rutas en Apache HTTP Server 2.4.50 permite leer archivos arbitrarios o ejecutar código remoto sin autenticación. Se originó debido a un...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...

cve-2020-0796

CVE-2020-0796 is caused by an error in the SMBv3 protocol when processing malicious compressed packets; when decompressing packets using the length passed from the client, the length is not checked for validity, ultimately leading to integer overflow. It allows a remote, unauthenticated attacker ...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated RCE PoC Disclaimer This repository was created for security research and educational purposes only. Use it only in an isolated lab environment. Using it against unauthorized systems is a violation of the Information and Communications Network Act and is...

CVE-2023-6444-POC

CVE-202306444-POC Proof of concept on Unauthenticated Administrator Email Disclosure CVE-2023-6444 Usage: python3 cve-2023-6444.py $URL https://vulners.com/cvelist/CVELIST:CVE-2023-6444...

CVE-2023-4220-Proof-of-concept

CVE-2023-4220-Proof-of-concept Chamilo LMS Unauthenticated Big Upload File that allows remote code execution CODE IS MADE AND USED FOR HACKTHEBOX CTF PERMX Unauthenticated file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS the php...

blackash-cve-2025-6389

🔥 CVE-2025-6389 — WordPress Zero-Day Crítico RCE wpvultheme 🧩 ¿Qué es? CVE-2025-6389 es una vulnerabilidad Crítica CVSS 9.8 en el plugin de WordPress Sneeit Framework ≤ 8.3, muy utilizado por temas populares. Permite ejecución remota de código sin autenticación — la clase más peligrosa de...

CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds = 3.11.1 imageupload Task → No Auth → 3-String Filter Bypass Overview Unauthenticated arbitrary file upload in DJ-Classifieds for Joomla. The imageupload task endpoint processes file uploads without authentication and relies on a 3-string blocklist ?php, eval, that...

Exploit_CVE-2025-37164

ExploitCVE-2025-37164 ! This Script is made for educational purpose only Exploit for the CVE-2025-37164 Description : This script provide a simple exploit for the CVE-2025-37164 impacting HPE OneView that can be used to validate if an asset is vulnerable. usage : root@kitploit: git clone...

CVE-2025-52694-POC

CVE-2025-52694: Advantech SaaS Composer SQL Injection This repository contains Proof-of-Concept PoC tools for CVE-2025-52694 , a critical unauthenticated SQL Injection vulnerability affecting Advantech IoTSuite and IoT Edge Products. Vulnerability Overview...

CVE-2025-49132-PHP-PEAR

CVE-2025-49132: Pterodactyl Panel Unauthenticated RCE via PHP PEAR Method Table of Contents Overview Vulnerability Details Technical Analysis Exploit Flow Installation Usage Examples Mitigation Disclaimer References Author Overview This repository contains a proof-of-concept PoC exploit for...

CVE-2024-36991-Tool

CVE-2024-36991-Tool This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and saves them locally for further analysis. The script is modular, allowing users to target specific file categories e.g...

CitrixBleedCVE-2026-8452-2025-5777

CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing. https://satoshi-box.com/pay/CSHeT8...

CVE-2025-5304

CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation 🚀 PT Project Notebooks ≤ 1.1.3 — Unauthenticated Privilege Escalation CVE-2025-5304 PoC & exploit helper for PT Project Notebooks versions 1.0.0–1.1.3 : Missing authorization in...

CVE-2019-19781-CitrixRCE

Atacante de Ejecución Remota de Código no Autorizada en Citrix - CVE-2019-19781 Referencias: https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ Evasión: 1 - Scripts eliminados/modificados en: /vpn/../vpns/portal/scripts/ 2 - Problemas de barra diagonal "/"...

Interpreter-HackTheBox

Interpreter — HackTheBox Platform: HackTheBox OS: Linux Status: Retired — full walkthrough published. Full walkthrough: l3dsec.com/walkthroughs/interpreter-htb Attack Chain root@kitploit: Nmap → Mirth Connect 4.4.0 80/443 → CVE-2023-43208 unauthenticated Java deserialization RCE → Shell as mirth ...

CVE-2015-9331

CVE-2015-9331 POC Vulnerability Description CVE-2015-9331 is an arbitrary file upload vulnerability in the WordPress plugin WP All Import. This vulnerability allows an unauthenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution. Affected Versions...

Strapi-RCE

Strapi-RCE Exploit script showcasing a mixture of CVE-2019-18818 and CVE-2019-19609 for unauthenticated remote code execution in Strapi CMS. Exploit This script exploits a vulnerability in Strapi CMS versions 3.0.0-beta.17.4 and lower, allowing for unauthenticated remote code execution. Descripti...