NeuVector - Information Disclosure

NeuVector through 5.4.9 contains an information disclosure vulnerability caused by missing authentication and cached sensitive data in the manager /network/graph API, letting remote attackers access sensitive information, exploit requires no special privileges. id: CVE-2026-25703 info: name:...

Bank Locker Management System - Cross-Site Scripting

A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate...

Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it...

SecurEnvoy Two Factor Authentication - LDAP Injection

Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote attacker could exfiltrate data from Active Directory through blind LDAP injection attacks against the DESKTOP service exposed on the...

WordPress Symposium <=15.8.1 - Cross-Site Scripting

WordPress Symposium through 15.8.1 contains a reflected cross-site scripting vulnerability via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter which allows an attacker to steal cookie-based authentication credentials and launch other attacks. id: CVE-2015-9414 info: name:...

Academy LMS 6.2 - Cross-Site Scripting

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument...

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...

FastChat - Open Redirect

Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs. id: CVE-2024-10908 info: name: FastChat - Open Redirect author: DhiyaneshDK severity: medium description: | Detects an open redirect vulnerability in lm-sys/fastch...

Landray EKP - Path Traversal

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to...

NS-ASG Application Security Gateway 6.3 - Sql Injection

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /protocol/index.php. The manipulation of the argument IPAddr leads to sql injection. It is possible to initiate the attack remotely. The...

raven

Raven - 高度なサイバー脅威マップ（シンプル、カスタマイズ可能、レスポンシブ。D3.jsとTOPO JSONを使用し、247の国、約10万都市をカバー。外部ルックアップなしで隔離環境で使用可能！） 構造 オフライン - デモ Firefox, Chrome, Safari ライブ - 500回の攻撃を一度にリグレッション Firefox, Chrome, Safari ライブ - デモ Firefox, Chrome, Safari https://qeeqbox.github.io/raven/ 特徴 D3.jsを使用（Anime.jsではありません）...

raven

Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Structure Offline - Demo Firefox, Chrome or Safari Live - Regression 500 attacks at onc...

scared

SCAred scaredは、eShardチームがメンテナンスするサイドチャネル解析フレームワークです。 はじめに 必要条件 Scaredには、Python 3.11 、3.12 、3.13 と Numpy =2 が必要です。 お使いの環境に応じて、scared をインストールできます： ソースから pip で conda で conda でインストール 次のコマンドを実行するだけです： root@kitploit: conda install -c eshard scared pip でインストール PythonのホイールはPypiから入手できます。次のコマンドを実行してください：...

httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: root@kitploit: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg...

httpdoom

HttpDoom - HTTPアタックサーフェスアナライザー 大規模なHTTPベースのアタックサーフェスを非常に高速かつ信頼性高く検証します。Aquatoneに触発されました。 インストール dotnet SDK バージョン6以上が必要です: root@kitploit: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg\ httpdoom.console アンインストール: root@kitploit: $ dotnet tool uninstall -g...

lvi-lfb-attack-poc

LVI-LFB控制流劫持攻击（CVE-2020-0551）的PoC 本仓库包含LVI-LFB控制流劫持攻击PoC的源代码。 内容 lvi-cfh-poc - 通过行填充缓冲区喷射劫持另一个进程的控制流 白皮书 前提条件 1. Visual Studio 2015 2. 存在漏洞的Intel CPU 作者 Andrei Vlad LUȚAȘ Dan Horea LUȚAȘ 附加资源...

DMA-ProcessDumper

DMA-ProcessDumper 使用 DMA 与 MemProcFS 通过 PCIe FPGA 设备在用户态转储目标进程的完整内存 构建 将 MemProcFS 中的 leechcore.h、vmmdll.h 和 vmm.lib 复制到 DMA-ProcessDumper 目录 使用 Visual Studio 编译 将 MemProcFS 中的 leechcore.dll、vmm.dll 和 FTD3XX.dll 复制到 DMA-ProcessDumper\x64 目录 用法 root@kitploit: DMA-ProcessDumper.exe target.exe 资源...

k8scout

k8scout ベータ版 — 許可されたセキュリティ評価のためのシングルバイナリ Kubernetes 攻撃パスエンジン。 侵害されたPodにドロップして実行するだけで、現在の足場からクラスタ管理者、ノードアクセス、シークレット窃取、クラウドIAMロールまでの現実的なすべてのエスカレーションパスのマップを取得できます。 概要 Kubernetes PodでRCEを取得しました。次はどうしますか?...

infernal-twin

Infernal-Wireless v3 Release 3 Improved and Compatibility on Kali Linux 2018 Added Visual Representation of Wireless Scan Added Visual Representation of Probe Requests and Map per SSID requested by Devices Updated MAC address mapping Added MAC address mappting on probe request devices Evil Twin...

Hashcat-Cheatsheet

Chuleta de Hashcat Chuleta de Hashcat para OSCP https://hashcat.net/wiki/doku.php?id=hashcat Identificar hashes hash-identifier Hashes de ejemplo: https://hashcat.net/wiki/doku.php?id=examplehashes ¡MÁXIMA POTENCIA! He descubierto que puedo exprimir un poco más de potencia al crackear hashes...