Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-2294 — Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion | Kitploit
Tools/GitHubGitHub/yucaerin/cve-2025-2294
Vulnerability AnalysisCode AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubyucaerin/cve-2025-2294

CVE-2025-2294

Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion

View Repository
1111 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-4403 Exploit

Details

  • Published: March 27, 2025
  • Updated: March 28, 2025
  • Severity: Critical (CVSS Score: 9.8)
  • CWE: CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • Affected Versions: All versions from n/a through 2.5.1
  • Researcher: https://www.wordfence.com/threat-intel/vulnerabilities/researchers/michael-mazzolini

CVSS Vector

  • CVSS Version: 9.8
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Usage

root@kitploit:~
usage: python3 CVE-2025-2294.py

Script Details

Requirements

  • Python 3.x
  • requests library

Installation

  1. Clone the repository:

    root@kitploit:~
    git clone https://github.com/Yucaerin/CVE-2025-2294.git
cd CVE-2025-2294

  2. Install the required Python packages:

    root@kitploit:~
    pip install requests

NOTE

root@kitploit:~
the exploit can be chained to RCE!

0001

Disclaimer

This script is intended for educational purposes only. Use it responsibly and only on systems for which you have explicit permission. Unauthorized use of this script is illegal and unethical.

Download Tool