Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-47668 — PoC exploit for unauthenticated remote code execution in DBGate via the /runners/start endpoint, with blind RCE mode and container-based testing scripts. | Kitploit
Tools/GitHubGitHub/s-vx/cve-2026-47668
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubs-vx/cve-2026-47668

CVE-2026-47668

PoC exploit for unauthenticated remote code execution in DBGate via the /runners/start endpoint, with blind RCE mode and container-based testing scripts.

View Repository
21 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-47668

Unauthenticated RCE in DBGate <= 7.1.8

  • REF1: https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc
  • REF2: https://github.com/Nxploited/CVE-2026-47668

rce.py

Minimal implementation of RCE on /runners/start,

Privileged

If process can write to ./public/ folder, file /favicon.svg is used to retrieve command output.

root@kitploit:~
$ rce.py whoami
root

If not, then command will run blind:

root@kitploit:~
./rce.py -b sleep 300

run.sh / shell.sh

Run local containers using podman, check UID variable to run process with distinct privileges.

Download Tool