CVE-2022-46169

Here is the transformed explanation document: CVE‑2022‑46169 – Explanation & Project Overview Cacti Unauthenticated Remote Code Execution What is this project? This project is a cybersecurity assignment demonstrating CVE‑2022‑46169 : a critical vulnerability in the open-source network monitoring...

CVE-2026-3854-PoC

CVE-2026-3854 PoC — GitHub RCE via X-Stat Push Option Injection For educational and authorized security research purposes only. Do not use against any system without explicit written permission. Overview CVE-2026-3854 is a Remote Code Execution vulnerability in GitHub Enterprise Server's and...

CVE-2020-24955

CVE-2020-24955 SUPERAntiSpyware Professional X Trial = 10.0.1206 Local Privilege Escalation SUPERAntiSpyware Professional X Trial versions prior to 10.0.1206 are vulnerable to local privilege escalation because it allows unprivileged users to restore quarantined files to a privileged location...

reapoc

reapoc OpenSource Poc && Vulnerable-Target Storage Box. We are aming to collect different normalized poc and the vulerable target to verify it. Now reapoc support these poc: pocsploit: My new simple, smart poc framework, welcome! nuclei: Famous in the world, yaml-based xray: yaml-based pocsuite3:...

PT-2026-90987

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003819)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003819 advisory. Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This ma...

Fix-Apple-Mail-CVE-2020-9922

Fix-Apple-Mail-CVE-2020-9922 Apple Mail has a scary zero-click vulnerability. Versions of OS X prior to High Sierra were not patched. https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c I made this quickly and only tested it on Mavericks. I don't see any...

mantis_rce

mantisrce Python script to obtain RCE on Mantis Bug Tracker prior to version 1.2.x Check CVE-2008-4687 for additional information...

CVE-2026-38526-KrayinCRM-RCE

CVE-2026-38526 - Krayin CRM RCE xpl0ited by infrar3d This is a Remote Code Execution RCE proof-of-concept specifically designed for Krayin CRM v2.2.x, an open-source customer relationship management system. The script automates the exploitation of a file upload vulnerability in the CRM's...

CVE-2022-46169

CVE-2022-46169 Cacti ブラインドリモートコード実行（事前認証不要） 免責事項 これは教育目的のみです。私はあなたの行動に対して一切責任を負いません。自己責任で使用してください。 説明 このスクリプトは、この脆弱性を悪用するために必要な変数をブルートフォースします。このエクスプロイトには以下の3つの変数が必要です。 ホワイトリストに登録されたIPアドレス 正しい hostid パラメータ 正しい localdataids パラメータ ファイル remoteagent.php はIPホワイトリストによって保護されています。X-Forwarded-IP...

Vuln-Next.js-CVE-2025-29927

root@kitploit: npx [email protected] Install packages root@kitploit: npm install -D @types/bcrypt npm install mysql2 npm install jose npm install -D @types/jsonwebtoken Prepare DB root@kitploit: CREATE TABLE users id INT PRIMARY KEY AUTOINCREMENT, username VARCHAR255 UNIQUE NOT NULL, passwor...

NextJS_CVE-2025-29927

Next.js Authorization Bypass Demo This application demonstrates the x-middleware-subrequest vulnerability in Next.js 13.4.19, which allows bypassing middleware protection. Setup 1. Install dependencies: root@kitploit: npm install 2. Start the development server: root@kitploit: npm run dev...

CVE-2022-4539

使用上の注意点: 適応性: ペイロード、IP生成ロジック、プロキシを簡単に変更して、さまざまなシナリオや環境に合わせることができます。 倫理的使用: このコードでシステムをテストする前に、明示的な許可を得ていることを確認してください。 スケーラビリティ: このコードはスケーラブルで適応性があるように設計されており、小規模なテストから大規模で高度な評価の両方に適しています。 WordPress用のWeb Application...

log4j-jndi-be-gone

log4j-jndi-be-gone A Byte Buddy Java agent-based fix for CVE-2021-44228, the log4j 2.x "JNDI LDAP" vulnerability. It does three things: Disables the internal method handler for jndi: format strings "lookups". Logs a message to System.err i.e stderr indicating that a log4j JNDI attempt has been ma...

x-middleware-exploit

This repository does not have a README...

HydraDragonAV-Mobile

🐉 HydraDragonAV Mobile Advanced Android Antivirus With Threat Protection ⚠️ Project on hold. This project did not get enough interest, so I have paused it for a while. Development has moved to HydraDragonAntivirus. Discord Community Server: https://discord.gg/7XMCuj5mbP Logo made by discord user...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware 15.2.2 - 認証バイパス ⚠️ NextJS Middleware における重大な認証バイパス 🛠️ @zs1n による PoC 実装 💡 概要...

CVE-2019-11287

CVE-2019-11287: DoS via Heap Overflow in RabbitMQ Web Management Plugin Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is...

cve-2025-29927

cve-2025-29927 CVE-2025-29927 is a critical vulnerability in Next.js, a popular React-based web framework. The flaw exists in how the middleware feature handles certain internal headers — specifically, the x-middleware-subrequest header...

next-attack

This is a Next.js project bootstrapped with create-next-app. Testing the vulnerability First, you can confirm that the middleware works and should redirect the user: root@kitploit: curl http://localhost:3000/api/admin Then, you can show how the middleware is being bypassed with the followign...