CVE-2025-53770

SharePoint ToolPane RCE Exploit Security research toolkit for testing SharePoint ToolPane vulnerabilities Overview • Features • Getting started • Usage • Project structure This repository contains proof-of-concept exploits and analysis tools for the SharePoint ToolPane vulnerability CVE-2025-5377...

CVE-2025-24016-Wazuh-Remote-Code-Execution-RCE-PoC

🚨 Wazuh Remote Code Execution RCE - PoC 📌 Vulnerability Summary A critical RCE vulnerability has been identified in the Wazuh server due to unsafe deserialization in the wazuh-manager package. This bug affects Wazuh versions ≥ 4.4.0 and has been patched in version 4.9.1. 🔍 Details The flaw lies i...

CVE-2025-55182

React2Shell PoC This repository provides a minimal intentionally vulnerable environment to test security scanners against the recent critical RCE vulnerability React2Shell affecting React Server Components and Next.js. CVE-2025-55182 : A pre-authentication remote code execution vulnerability exis...

CVE-2026-59827

CVE-2026-59827 — Unsafe Deserialization of H2 Query Results in Metabase GHSA-w95f-x9v9-wv36 | CVSS 9.9 Critical | CWE-502: Deserialization of Untrusted Data Overview CVE-2026-59827 is a critical remote code execution vulnerability in Metabase, the popular open-source business intelligence and dat...

CVE-2020-9496

CVE-2020-9496 XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 Install requirements root@kitploit: $ pip install -r requirements.txt $ wget https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.ja...

React2Shell-PoC

React2Shell-PoC A proof-of-concept exploit for CVE-2025-55182 and CVE-2025-66478 , critical Remote Code Execution vulnerabilities in React Server Components RSC and Next.js applications. Overview React2Shell demonstrates the exploitation of unsafe deserialization in Next.js server action handlers...

CVE-2025-24016

Wazuh Remote Code Execution RCE - PoC Vulnerability Overview This repository demonstrates the remote code execution RCE vulnerability in the Wazuh server, introduced by an unsafe deserialization in the wazuh-manager package. The vulnerability allows remote attackers with API access compromised...

react2shell-lab

React2Shell - CVE-2025-55182 Lab A comprehensive laboratory for demonstrating and testing the critical vulnerability CVE-2025-55182 in React Server Components. ⚠️ Educational Purpose Only This repository is intended for: Security research and education Understanding vulnerability mechanisms Testin...

CVE-2018-2628

CVE-2018-2628 A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Detailed Steps to Reproduce CVE-2018-2628: 0x01 Run the following command on the JRMPListener host: root@kitploit: wget...

poc-cve-2025-55182

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ WARNING: This repository is for educational and security research purposes only. Do not use this exploit against systems you do not own or have explicit permission to test. Overview This repository contains a proof-of-concept demonstration of...

CVE-2025-53772

CVE-2025-53772 - Microsoft Web Deploy RCE Exploit A Python-based exploit for CVE-2025-53772, a remote code execution vulnerability in Microsoft Web Deploy msdeploy caused by unsafe deserialization of HTTP header data. 🎬 POC Video Vulnerability Overview...

CVE-2020-9496

CVE-2020-9496 - RCE Because the 2 xmlrpc related requets in webtools xmlrpc and ping are not using authentication they are vulnerable to unsafe deserialization. This issue was reported to the security team by Alvaro Munoz [email protected] from the GitHub Security Lab team. This vulnerabilit...

CVE-2025-24016-Nuclei-Template

CVE-2025-24016 Wazuh Unsafe Deserialization RCE Detection This repository contains a Nuclei template to detect the unsafe deserialization vulnerability in Wazuh servers, identified as CVE-2025-24016. Template Details root@kitploit: id: wazuh-unsafe-deserialization info: name: "Wazuh Unsafe...

cve-2025-55182-react2shell_reproduction

CVE-2025-55182 — React2Shell CVSS 10.0 CRITICAL | Pre-Auth Remote Code Execution in React Server Components Discovered by Chinese threat actors. Actively exploited by China-nexus APT groups. Overview Dubbed "React2Shell" , this vulnerability enables unauthenticated remote code execution via unsaf...

CVE-2025-59287-WSUS-2

CVE-2025-59287 ⚠ This tool is created solely for educational use only. Unauthorized use outside of controlled environments is strictly prohibited. CVE-2025-59287 is a critical remote code execution vulnerability in Microsoft Windows Server Update Services WSUS. It stems from unsafe deserializatio...

CVE-2019-0192

CVE-2019-0192 - Apache Solr RCE 5.0.0 至 5.5.5 及 6.0.0 至 6.6.5 这是 Apache Solr RCE 的早期 PoC 来自 https://issues.apache.org/jira/browse/SOLR-13301: ConfigAPI 允许通过 HTTP POST 请求配置 Solr 的 JMX 服务器。 通过将其指向一个恶意的 RMI 服务器，攻击者可以利用 Solr 的不安全反序列化，在 Solr 端触发远程代码执行。 概念验证 通过查看安全公告的描述并检查 Apache Solr 的 ConfigAPI...

CVE-2020-17144

weaponized tool for CVE-2020-17144Microsoft Exchange 2010 MRM.AutoTag.Model unsafe deserialize vulnerability build install .net framework 3.5 first, then make. usage root@kitploit: CVE-2020-17144 After exploit, access http://target/ews/soap/?pass=whoami to get command execution. And you can also...

CVE-2025-24016

CVE-2025-24016 An unsafe deserialization vulnerability in Wazuh servers allows remote code execution through unsanitized dictionary injection in DAPI requests/responses. This issue arises from the way DistributedAPI parameters are serialized as JSON and then deserialized using the aswazuhobject...

CVE-2025-55182

CVE-2025-55182 - React2Shell React Server Components 中的预认证远程代码执行漏洞。 CVE 摘要 一个预认证远程代码执行漏洞存在于 React Server Components 的 19.0.0、19.1.0、19.1.1 和 19.2.0 版本中，包括 react-server-dom-parcel、react-server-dom-turbopack 和 react-server-dom-webpack 包。存在漏洞的代码不安全地将 HTTP 请求中的负载反序列化到 Server Function 端点。 受影响版本 React...

CVE-2020-9496

CVE-2020-9496 ApacheOfBiz 17.12.01 - Unauthorized Remote Code Executión XML-RPC request are vulnerable to unsafe deserialization. Steps Step 1: pip3 install -r requeriments.txt Step 2: nc -nlvp attack computer Step 3: python3 shell.py -i -p -li -lp Step 4: You should have a shell in your nc liste...