117344 matches found
ms15-034-Scan
ms15-034-scan python3 Batch scan for ms15-034/CVE-2015-1635 vulnerability Usage root@kitploit: python3 ms-socket.py url.txt Add assets to url.txt yourself Output to result.txt Did not remove http:// and https:// Replace manually in notepad using ctrl+h...
CVE-2025-31486
CVE-2025-31486-PoC.py url image For details on vulnerability reproduction and specific environment setup, please refer to：https://chenchena.blog.csdn.net/article/details/147150357?spm=1001.2014.3001.5502...
CVE-2024-4577
Put the files to be scanned into urls.txt and then directly run POC.py Execute the command using EXP.py...
CVE-2026-73551
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...
CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...
CVE-2026-46650
Joplin (open-source note-taking app) prior to 3.7.2 contains a stored XSS in the public share viewer. The root cause is an unanchored regular expression in isAcceptedUrl() (packages/renderer/htmlUtils.ts) that allows a javascript: URL containing a matching 32-character path fragment to pass valid...
CVE-2026-59816
Joplin Server (prior to 3.7.7 ) is vulnerable to a path traversal in its transcription proxy endpoints. When TRANSCRIBE_ENABLED=true, the GET and POST /api/transcribe/:id handlers pass the decoded job ID directly into backend URLs. An authenticated user can inject URL-encoded slash and parent-dir...
CVE-2026-59816 Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBEENABLED=true pass t...
CVE-2026-49449 Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passi...
CVE-2026-49449 Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passi...
EUVD-2026-84168
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passi...
CVE-2025-60876
CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...
CVE-2026-51385
CVE-2026-51385 Advisory for CVE-2026-51385. Needed to publish it as GRAPHIFY hasnt recognized the advisory neither publish it, and MITRE assigned CVE-2026-51385, this is the advisory for it. ES: Este fue mi primer cve, para ser honesto encontre una manera de romper la logica en la funcion ANTI...
EUVD-2026-84119
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...
CVE-2017-12149
CVE-2017-12149 Many thanks to Master yunxu1 for the source code Description: root@kitploit: Removed the graphical interface Fixed command execution failure caused by system identification errors Changed to an interactive shell Usage Enter the URL and press Enter; it will automatically execute...
CVE-2017-1000117
CVE-2017-1000117 Project Introduction One of the selected topics for the cybersecurity course project Reproduction of CVE-2017-1000117 vulnerability PoC + Exploit Git + SSH Vulnerability Introduction: Vulnerability Name: Git command injection vulnerability CNNVD ID: CNNVD-201708-670 Hazard Level:...
CVE-2024-38475_SonicBoom_Apache_URL_Traversal_PoC
CVE-2024-38475SonicBoomApacheURLTraversalPoC Author: abrewer251 A proof-of-concept tool for testing CVE-2024-38475 "SonicBoom" Apache URL traversal vulnerability. This script automates TLS negotiation, directory scanning, traversal verification, and payload fuzzing to identify unauthorized file...
drupal-openai-provider-ssrf-cve-2026-13233
Drupal OpenAI Provider — SSRF / lectura de archivos locales mediante la URL de la respuesta CVE-2026-13233 Upstream no confiable: el proveedor que descargó la URL que su propia respuesta le indicaba. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053...
ApacheStruts-CVE-2018-11776
Apache Struts CVE-2018-11776 Python PoC This is based on https://github.com/hook-s3c/CVE-2018-11776-Python-PoC. The container build and instructions did not work as described in the README so this fork was created. The POC exploit used is from Rapid7. Shoutout: hook-s3c github.com/hook-s3c,...