RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:69099)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:69099 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable...

CVE-2026-94095 Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/networktools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be...

CVE-2026-85706-gitlab-poc

CVE-2026-85706 Description GitLab CE/EE unauthenticated arbitrary file read vulnerability CVE-2026-85706. Affected versions: GitLab CE/EE 18.7 – 19.1.7 GitLab CE/EE 19.2.0 – 19.2.5 GitLab CE/EE 19.3.0 – 19.3.1 Patched versions: GitLab 19.1.8 GitLab 19.2.6 GitLab 19.3.2 Vulnerability Details The...

CVE-2026-54356

CVE-2026-54356 — Budibase: authenticated arbitrary S3 signed upload URL issuance A low-privilege BASIC role authenticated user of a published Budibase workspace can call POST /api/attachments/:datasourceId/url and obtain an S3 pre-signed upload URL signed with the workspace datasource's server-si...

CVE-2023-27163-lab

CVE-2023-27163 — Request-Baskets SSRF Lab Project: Vulnerability Research & Reproduction Lab — CVE-2023-27163 Author: Amulya Kaushik Role: Cybersecurity R&D & Lab Content Development Intern Candidate Server-Side Request Forgery in Request-Baskets ≤ 1.2.1 A self-contained local research lab for...

CVE-2023-42793

About CVE-2023-42793 You will need to obtain the token first through using different exploit. However, the following exploit will allow you to obtain RCE into the Linux server as it encoded the payload in URL and sends it to the server. How to use root@kitploit: python3 ./main -t TEAMCITYTOKEN -u...

CVE-2022-30190

CVE-2022-30190 On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool MSDT in Windows vulnerability. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who...

apache-struts-pwn_CVE-2017-9805

apache-struts-pwn - CVE-2017-9805 Exploit An exploit for Apache Struts CVE-2017-9805 Usage Check if the vulnerability exists against a single URL. python apache-struts-pwn.py --url 'http://example.com/struts2-rest-showcase/orders/3' Check if the vulnerability exists against a list of URLs. python...

thingsboard-ssrf-cve-2025-34282

CVE-2025-34282 — ThingsBoard SSRF via SVG Image Upload Overview Server-Side Request Forgery SSRF vulnerability in ThingsBoard IoT Platform versions before 4.2.1. An attacker with Tenant Admin access can upload a crafted SVG file containing an internal URL reference via the Image Upload Gallery...

CVE-2025-55752

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability A Docker-based reproduction environment to reproduce the path traversal vulnerability CVE-2025-55752 in Apache Tomcat 10.1.44. Overview CVE-2025-55752 is a path traversal vulnerability in the RewriteValve component of Apache Tomcat, cause...

CVE-2023-27163---SSRF-Baskets-Requests

CVE-2023-27163---SSRF-Baskets-Requests Creado por TheAlchimist root@kitploit: cve-2023-27163-ssrfbaskets.py ejemplo : cve-2023-27163-ssrfbaskets.py http://mysite.com http://localhost...

SealSecurity_Exam

SealSecurityExam La contaminación de prototipos es una vulnerabilidad de JavaScript que permite a un atacante agregar propiedades arbitrarias a los prototipos de objetos globales, que luego pueden ser heredadas por objetos definidos por el usuario. Una fuente de contaminación de prototipos es...

CVE-2024-0195

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2024-0195 Run bellow command to check CVE-2024-0195 -h Configurations 2. We integrated with the Telegram API...

CVE-2023-24044

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2023-24044 Run bellow command to check CVE-2023-24044 -h Configurations 2. We integrated with the Telegram A...

claude-code-security-audit

Claude Code Security Audit & CVE-2026-21852 Scanner A security audit and environment hardening tool for Anthropic's Claude Code agentic CLI. Scans repositories for CVE-2026-21852 pre-trust execution surfaces, hook hijacking, malicious base URL redirection, and unauthenticated token exfiltration...

CVE-2022-21371

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2022-21371 Run bellow command to check CVE-2022-21371 -h Configurations 2. We integrated with the Telegram A...

CVE-2020-3452

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2020-3452 Run bellow command to check CVE-2020-3452 -h Configurations 2. We integrated with the Telegram API...

CVE-2015-1635

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install CVE-2015-1635 Run bellow command to check CVE-2015-1635 -h Configurations 2. We integrated with the Telegram API...

CVE-2020-28415

CVE-2020-28415 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url different vector than CVE-2020-28414. Vulnerability Type Cross Site...

mkpath

mkpath Make URL path combinations using a wordlist Read a wordlist file and generate path combinations for given domain or list of domains. Input from wordlist file is lowercased and unique words are processed. Additionally, wordlist can be filtered using regex. When you use mkpath's -l parameter...