CVE-2019-5418

CVE-2019-5418 sandbox https://groups.google.com/forum/!msg/rubyonrails-security/zRNVOUhKHrg/GmmcVXcmAAAJ initialize root@kitploit: $ git clone https://github.com/takeokunn/CVE-2019-5418 $ cd https://github.com/takeokunn/CVE-2019-5418 $ docker-compose up Usage root@kitploit: $ curl localhost/sandb...

CVE-2019-5418

CVE-2019-5418 Test case Run : root@kitploit: $ rails s PoC : root@kitploit: Accept: ../../../../../../../../etc/passwd Req 1 - root@kitploit: GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept:...

CVE-2021-31166

CVE-2021-31166 Detection of attempts to exploit CVE-2021-31166 HTTP Protocol Stack vulnerability Suricata rule Zeek Package References https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166...

cve-2022-21907

CVE-2022-21907 Golang Application by 1vere$k CVE-2022-21907 - Double Free in http.sys driver. Summary This is a multithreading Golang application wich allows make requests on few targets simultaneously. Not very productive with the POST requests but it provides nearly 30% of speed comparing to a...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

Accept Donations with PayPal <= 1.5.2 - Open Redirect

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially...

LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install root@kitploit: $ pip install hsecscan Usage root@kitploit: $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D...

CVE-2021-31166

CVE-2021-31166 Why I recently wrote an exploit for CVE-2021-31166, it exploit CVE-2021-31166 and CVE-2021-31166. A pentester should use https://github.com/mauricelambert/CVE-2021-31166, but in SOC teams we need to know the specific vulneraility to fix it properly, which is why i wrote this exploi...

CVE-2022-21907-http.sys

CVE-2022-21907 - Double Free in http.sys driver CVE-2022-21907 - Double Free in http.sys driver Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to...

cve-2022-21907-http.sys

cve-2022-21907-http.sys by 1vere$k CVE-2022-21907 - Double Free in http.sys driver. Summary An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack http.sys to process...

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

cve-2017-8890-msf

Module: Phoenix Talon CVE 2017-8890 This may resolve issue 8571, which requests Phoenix Talon modules. Overview of 2017-8890 This CVE: is the most serious member of the Phoenix Talon class of Linux kernel vulnerabilities. No POC of this CVE exists in the Exploit DB. But other public POC's are...

CVE-2020-27223

CVE-2020-27223 Using root@kitploit: $ mvn spring-boot:run 9.4.36.v20210114 root@kitploit: $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s...

CVE-2026-93641

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

CVE-2026-93642 Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

EUVD-2026-87099

An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share, allowing the attacker to access mailbox data and act as the victim...

Linux Distros Unpatched Vulnerability : CVE-2026-61629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in...

CVE-2019-5418

CVE-2019-5418 - File Content Disclosure on Rails EDIT : this CVE can lead to a Remote Code Execution, more info: https://github.com/mpgn/Rails-doubletap-RCE There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to rend...

UBUNTU-CVE-2026-61629

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing an...