API-dnsdumpster.com

DNSDumpster API UNOFFICIAL ⚠️ IMPORTANT DISCLAIMER : This is an UNOFFICIAL API wrapper for dnsdumpster.com that scrapes the public website. DNSDumpster.com offers an official API plan for commercial and heavy usage. If you need reliable, production-grade access, please consider their official API:...

wp2shell

wp2shell Exploit WordPress REST API route confusion CVE-2026-63030 + SQL injection CVE-2026-60137 in the batch endpoint to achieve Remote Code Execution. Vulnerabilities Route Confusion CVE-2026-63030 The WordPress REST API batch endpoint /batch/v1 does not properly isolate request routing. By...

-CVE-2025-59528-PoC

CVE-2025-59528-PoC FOR EDUCATIONAL PURPOSES ONLY A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool, that is also part of an HTB seasonal challenge, on which I tested it btw. If it's not working, make sure the comman...

CVE-2025-49132-PoC

Guide to use script that exploit the Pterodactyl Path Traversal at locale.json Requirements Exposed Redis Server Panel URL Guide 1. Get access to the server configuration file, which has APPKEY and Redis Database Password + IP 2. Use forgecookie to generate a pterodactylsession cookie 3. Use that...

CVE-2018-7690

CVE-2018-7690 The SSC REST API contains Insecure Direct Object Reference IDOR vulnerabilities that allow authenticated users access to arbitrary details of the Local and LDAP users via POST method and to arbitrary details of other user's Fortify projects via GET method. Exploit-DB publication at...

pigeon

Pigeon Your agent spawned a sub-agent and handed it the same API key. That sub-agent can now deploy to production, read the payments database, and merge to main. Pigeon stops that. You hand the child a Pigeon Pass : a narrowed, signed credential for what it may do, not a copy of everything you ca...

CVE-2023-35078

CVE-2023-35078 Exploit Tool root@kitploit: ██████╗ ███╗ ██╗███████╗███████╗ ██████╗ ██╔═████╗████╗ ██║██╔════╝██╔════╝██╔════╝ ██║██╔██║██╔██╗ ██║███████╗█████╗ ██║ ████╔╝██║██║╚██╗██║╚════██║██╔══╝ ██║ ╚██████╔╝██║ ╚████║███████║███████╗╚██████╗ ╚═════╝ ╚═╝ ╚═══╝╚══════╝╚══════╝ ╚═════╝ +...

CVE-2025-4796

CVE-2025-4796 eventin and update the speaker email to an email they control. then the attacker can use wordpress password reset to take over the admin account. requirements: python 3.8 or higher requests install requests: pip install requests usage run the script and enter required values when...

CVE-2013-4710-WebView-RCE-Vulnerability

CVE-2013-4710-WebView-RCE-Vulnerability Vulnerability Description A lot of the time we use WebView to display a Webpage,for example many applications in order to achieve the server control, many results page is Webpage, rather than the local implementation, which has many advantages, such as...

Log4j_CVE-2021-44228

Log4j CVE-2021-44228 Solutions Think about if you actually really require Log4j2 Core. Most likely, your own code or some 3rd-party library you depend on only need Log4j's Logging API façade - but can log to another back-end. You could therefore simply completely exclude the...

CVE-2020-13937

Apache Kylin API Unauthorized Access Vulnerability CVE-2020-13937 Fofa:title="Kylin" Usage Help: python3 cve-2020-13937.py --help Single target: python3 cve-2020-13937.py -u http://127.0.0.1 Batch scan: python3 cve-2020-13937.py -f target.txt...

WuppieFuzz

WuppieFuzz v1.7.1 TNO developed WuppieFuzz, a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity. WuppieFuzz supports all three settings of testing black box,...

pmg

Package Manager Guard PMG Block malicious packages before they install...

CVE-2026-78905-Facebook-Account-Takeover

CVE-2026-78905 — Meta-Phishing Facebook Graph API — OAuth Token Reuse & Session Hijacking...

CVE-2025-9074-PoC-Bash

CVE-2025-9074-PoC-Bash The original PoC is: https://github.com/j3r1ch0123/CVE-2025-9074. This is new PoC in bash since not all docker containers has python installed, and mostly this should be run from inside a container. Steps From inside the container use the following to find vulnerable docker...

CVE-2017-5487-EXPLOIT

CVE-2017-5487 - WordPress User Enumeration A vulnerability has been discovered in the REST API implementation of WordPress 4.7 before 4.7.1. This vulnerability is present in the class-wp-rest-users-controller.php file located in wp-includes/rest-api/endpoints. The flaw arises from inadequate...

bola-CVE-2023-27524

bola-CVE-2023-27524 📄 README.md — BOLA CVE-2023-27524 Demo Project root@kitploit: 🔐 Broken Object Level Authorization BOLA Demonstration CVE-2023-27524 Security Analysis & Fix --- 📌 Project Overview This project demonstrates a real-world Broken Object Level Authorization BOLA vulnerability and it...

CVE-2026-54761-poc

CVE-2026-54761: Traefik Kubernetes Gateway crossProviderNamespaces Bypass PoC 日本語版はこちら Description This repository contains a local Proof of Concept PoC for CVE-2026-54761 , a high severity vulnerability in Traefik's Kubernetes Gateway provider. The vulnerability affects the crossProviderNamespac...

CVE-2024-21533-PoC-ggit

CVE-2024-21533 Argument Injection vulnerability in ggit ggit describes itself as: root@kitploit: Local promise-returning git command wrappers Resources: Project's GitHub source code: https://github.com/bahmutov/ggit Project's npm package: https://www.npmjs.com/package/ggit Article write-up on thi...

selenium-wire

Selenium Wire is no longer being maintained. Thank you for your support and all your contributions. Selenium Wire Selenium Wire extends Selenium's Python bindings to give you access to the underlying requests made by the browser. You author your code in the same way as you do with Selenium, but y...