EntraFalcon

EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...

macOS_security_audit

🔒 macOS Security Audit A Bash-based security auditing toolkit for macOS that checks system hardening settings against CIS Benchmark recommendations and generates JSON/HTML reports. Created by Bartłomiej Pogwizd · https://www.youtube.com/@pTech-pl Overview This toolkit consists of two scripts:...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

CVE-2021-29267

CVE-2021-29267 SherlockIM ChatBot XSS Suggested description: SherlockIM is vulnerable to Persistent XSS. Additional Information: SherlockIM - Platform for manage all kind of conversations with customers. Vulnerability Type: Cross Site Scripting XSS A letter was sent to the vendor about the...

CVE-2009-3036

CVE-2009-3036 SpeeDr00t@Black Falcon bid38241 Symantec IM Manager Console HTML Injection Vulnerability info discussion exploit solution references noexploitlink...

CVE-2026-58113

A stored XSS vulnerability in Siemens Teamcenter affects versions V2412 (below V2412.0013), V2506 (below V2506.0010), V2512 (below V2512.2607), and V2606 (below V2606.2607). The root cause is improper encoding of user-supplied input reflected into HTML attribute contexts within the authentication...

EUVD-2026-72659

A vulnerability has been identified in Teamcenter V2412 All versions V2412.0013, Teamcenter V2506 All versions V2506.0010, Teamcenter V2512 All versions V2512.2607, Teamcenter V2606 All versions V2606.2607. Affected applications do not properly encode user-supplied input reflected into HTML...

CVE-2023-2859

CVE-2023-2859: Stored HTML injection in folderName affecting Admin in TeamPass 3.0.9 - M Nadeem Qazi Hi, I have found a major vulnerability in the nilsteampassnet/teampass application that involves stored HTML injection in the FolderName field. By inserting malicious HTML code into the FolderName...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

java-html-sanitizer

OWASP Java HTML Sanitizer A fast and easy to configure HTML Sanitizer written in Java which lets you include HTML authored by third-parties in your web application while protecting against XSS. The existing dependency is on JSR 305. The other jars are only needed by the test suite. The JSR 305...

CVE-2017-16568

CVE-2017-16568 1. Exploit Title: Logitech Media Server : HTML code injection and execution. 2. Shodan Dork: Search Logitech Media Server 3. Date: 11/03/2017 4. Exploit Author: Dewank Pant 5. Vendor Homepage: www.logitech.com 6. Version: 7.9.0 7. Tested on: Windows 10, Linux POC: 1. Access and go ...

ParsingPeas

ParsingPeas 🥒 Automated PEASS collection + a clean, portable HTML report for CTF & lab privilege-escalation work. Run one command on the target. ParsingPeas pulls LinPEAS/WinPEAS from your Kali host, runs the scan, ships the output back, and turns it into a single self-contained HTML report you c...

Fudge

Fudge I had some success with on Phishing engagements by base64 encoding the contents of a file, putting it into a HTML file and having it decode and drop when the user opened the HTML file. Usage There are precompiled binaries available on the releases tab for both Windows 64-bit and Linux 64-bi...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup root@kitploit: pip3 install -r requirements.txt Run root@kitploit: python3 app.py Attacker Connec...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions. CWE CWE-79 — Improper Neutralization of Input During Web Page Generation Cross-site Scripting CVSS v3....

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Stored XSS via Tile HTML Field PoC This repository documents a proof-of-concept PoC for a stored cross-site scripting XSS vulnerability affecting the iOS mobile application of URVE Smart Office. Due to insufficiently implemented input validation, attacker-controlled...

BFuzz

BFuzz root@kitploit: BFuzz is currently in beta. BFuzz is an input based fuzzer tool which take .html as an input, open's up your browser with a new instance and pass multiple testcases generated by domato which is present in recurve folder of BFuzz, more over BFuzz is an automation which perform...

csv-plus_vulnerability

csv-plusvulnerability 👻 2-Click Arbitrary Code Execution Vulnerability. CVE-2022-21241 ⚠ This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks. Vulnerability The following versions are vulnerable. CSV+ click me 👻...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ ---------------------...

DPAT

Domain Password Audit Tool DPAT DPAT is a Python-based security tool that analyzes password hashes extracted from Active Directory domain controllers. It generates comprehensive HTML reports showing password usage statistics, policy violations, and security insights from both NTDS dumps and...