CVE-2026-37072

CVE-2026-37072 Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php An unauthenticated attacker can exploit a Local File Inclusion vulnerability in the 'lang' GET parameter. By sending a specially crafted POST request with t...

CVE-2026-63646

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

CVE-2026-63646 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/formKey calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/ as anonymous and the controller...

Config-Extractors

Malwares Decryptors...

Asyncrat-Venom-Dcrat-Config-Extractor

Asyncrat-Venom-Dcrat-Config-Extractor Static Config Extractor for Asyncrat/Dcrat/VenomRat Utilises dnlib to locate encrypted Config data and associated Encryption values. Values are decrypted in the script without emulating or executing malware code Assumes config lies under the Client.Settings...

AgentTesla-Config-Extractor

AgentTesla-Config-Extractor Config extractor for AgentTesla - Discord/Telegram Variant Usage agenttesla-config-extractor.py -f Example Output Example Hashes root@kitploit: 0de25252f312735c0a26f7ac7a27cc8a51bfcdd900fc2e8d0a8b65013988e7e9...

scavenger_scanner

CVE-2025-54313 IOC Scanner Cross-platform scanners for detecting Indicators of Compromise IOCs related to the eslint-config-prettier supply chain attack CVE-2025-54313. On July 18, 2025, several popular npm packages were compromised through a phishing attack. The attacker gained access to the...

CVE-2017-7921

CVE-2017-7921 exploit This script allows interaction with a CVE-2017-7921 vulnerable camera to perform the following operations: 1. Download and decrypt a configuration file, containing the camera's admin's password. 2. Continuously download images every second. 3. Convert a series of downloaded...

CVE-2026-61552

Icinga 2 , an open source monitoring and alerting system, is affected by a DSL injection vulnerability in the /v1/objects API . The root cause is that attacker-controlled template names are written into generated configuration without escaping , allowing an authenticated ApiUser with an objects/c...

EUVD-2026-83202

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2026-93763

This vulnerability affects Mongoid , a Ruby object-document mapper for MongoDB. A protection mechanism failure in the encryption configuration generation — specifically an unresolved callable database name in the encryption schema map — causes fields declared for client-side field-level encryptio...

CVE-2026-84398 CareCam CM2507 Empty Password in Configuration File

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...

CVE-2026-84398 CareCam CM2507 Empty Password in Configuration File

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information...

HikvisionExploiter_fixed

HikvisionExploiter Educational security tool for testing unsecured Hikvision exposures and checking CVE-2021-36260 in authorized environments. ⚠️ Legal and Ethical Warning This project should be used only on systems you own or have explicit permission to test. Scanning/exploitation without...

CLEANSTART-2026-SB47522 Security fix for CVE-2026-22741 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6

CVE-2026-22741 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YX18209 Security fix for CVE-2026-22745 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r1, apache-hive 4.1.0-r5, apache-nifi 2.6.0-r3, apache-nifi-registry 2.9.0-r3, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6, spring-boot 3.4.13-r3

CVE-2026-22745 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DZ11796 Security fix for CVE-2026-40973 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, kafka-ui 1.4.2-r6

CVE-2026-40973 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UJ95320 Security fix for CVE-2026-40976 applied in: cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0

CVE-2026-40976 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QX79556 Security fix for CVE-2026-43514 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0

CVE-2026-43514 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BN96016 Security fix for CVE-2026-42498 applied in: cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, cloud-config-server 5.0.2-r3, cloud-config-server 5.0.4-r0, thingsboard 4.2.2.3-r1, thingsboard 4.3.1.3-r1

CVE-2026-42498 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...