Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45507 info: name: Apache OFBiz -...

SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. id: CVE-2025-40536 info: name: SolarWinds Web Help Desk 12.8.8 Hotfix 1 HF1 - Security...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

Juiceshopgl

Juice Shop Logo OWASP Juice Shop Test Coverage Maintainability...

CVE-2002-0201

CVE-2002-0201 Il Cyberstop Web Server per Windows 0.1 consente ad attaccanti remoti di causare un denial of service crash e possibilmente eseguire codice arbitrario tramite una lunga richiesta HTTP GET, innescando possibilmente un buffer overflow. Pubblicazione su Exploit-db:...

Zoneminder

ADVISORY SUMMARY Successful exploitation of this vulnerability could result in full Remote Code Execution RCE as the web server user. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198 è una vulnerabilità critica nella funzionalità Web UI del software Cisco IOS XE, che consente a un aggressore remoto non autenticato di creare account con livello di privilegio 15 sui sistemi interessati, ottenendo così il controllo completo del dispositivo. La...

scout

Scout Scout is a URL fuzzer and spider for discovering undisclosed VHOSTS, files and directories on a web server. A full word list is included in the binary, meaning maximum portability and minimal configuration. Aim and fire! Usage root@kitploit: Usage: scout command Available Commands: help Hel...

CVE-2023-38829-NETIS-WF2409E

CVE-2023-38829-NETIS-WF2409E NETIS SYSTEMS Router WF2409E Proof of Concept di Iniezione di Comandi Descrizione della vulnerabilità: Le funzioni ping e traceroute del router NETIS SYSTEMS WF2409E versione V3.6.42541 sono suscettibili ad attacchi di iniezione di comandi. Input malevoli possono esse...

CVE-2021-36260

CVE-2021-36260 CVE-2021-36260 POC vulnerabilità di command injection nel web server di alcuni prodotti Hikvision. A causa di una validazione dell'input insufficiente, un attaccante può sfruttare la vulnerabilità per lanciare un attacco di command injection inviando messaggi con comandi malevoli...

CVE-2022-24715

Icinga Web 2 - Esecuzione remota di codice autenticata 2.8.6, 2.9.6, 2.10 Esecuzione remota di comandi Reverse shell Utilizzo root@kitploit: usage: exploit.py -h -u URL -U USER -P PASSWORD -i IP -p PORT Welcome. options: -h, --help show this help message and exit -u URL, --url URL Insert URL...

CVE-2022-24638

AS SEEN ON EXPLOITDB: https://www.exploit-db.com/exploits/51026 DIESE VERSION WURDE BEHOBEN, UM FALSCH NEGATIVE ZU VERHINDERN CVE-2022-24637 Exploit für die nicht authentifizierte RCE in Open Web Analytics OWA 1.7.4. Diese Arbeit basiert auf https://devel0pment.de/?p=2494. HAFTUNGSAUSSCHLUSS:...

cve-2026-43515-poc

CVE-2026-43515 — Bypass delle restrizioni di sicurezza in Apache Tomcat Giudizio di sfruttabilità: confermato sfruttabile. Una richiesta POST verso una risorsa protetta da una configurazione con divisa bypassa completamente l'autenticazione. La struttura web.xml richiesta è poco comune nelle...

WebGoat.NET

Webgoat.NET الكود المصدري: https://github.com/jerryhoff/WebGoat.NET تحميل zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master تطبيق الويب هذا هو منصة تعليمية تحاول التعليم عن عيوب أمن الويب الشائعة. يحتوي على عيوب أمنية عامة تنطبق على معظم تطبيقات الويب. كما يحتوي على دروس تتعلق تحديدًا ...

CVE-2023-4220-RCE

CVE-2023-4220-RCE Sommario Avviso di Starlabs Prodotto interessato: Chamilo , -p --port REMOTE PORT -c --comand Flag per la reverse shell -lh/--localhost: IP dell'attaccante -lp/--localtcat porta listener...

webshell

webshell 简体中文 This is a webshell collection project Give someone a rose, there is a fragrance in your hand if you download this project, please also submit a shell This project covers various common scripts Such as: asp, aspx, php, jsp, pl, py If you submit a webshell, please do not change the na...

archiver-MOTW-support-comparison

Confronto del supporto alla propagazione di MOTW Mark of the Web nei software di compressione per Windows Inglese | Giapponese Contesto Il 3 marzo 2022, Microsoft ha annunciato che il comportamento predefinito delle applicazioni Office su Windows verrà modificato per bloccare le macro nei file...

CVE-2026-7777-Rust-Use-After-Free-in-Unsafe-Web-Server

CVE-2026-7777 – असुरक्षित वेब सर्वर में Rust Use‑After‑Free प्रोग्राम कोड Rust root@kitploit: // uafserver.rs - Vulnerable Rust HTTP server with use-after-free use std::sync::Arc, Mutex; use std::thread; use std::io::prelude::; use std::net::TcpListener, TcpStream; struct SharedBuffer data: Vec,...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

Scannerweb

Scannerweb Scanner di vulnerabilità scritto in python3, effettua fuzzing su tutti gli URL del sito target e poi li scansiona per Scannerweb Screeenshot Naviga nella directory /opt opzionale root@kitploit: cd /opt/ Clona questo repository root@kitploit: git clone...