Lucene search
+L

1250 matches found

Kitploit
Kitploit
•added 2026/09/26 6:53 a.m.•13 views

extended-xss-search

확장형 XSS 검색 및 찾기 이것은 이미 "xssfinder"로 공개된 초기 아이디어를 기반으로 한 확장 버전입니다. 이 개인 버전은 공격자가 GET뿐만 아니라 POST 요청도 수행할 수 있도록 합니다. 또한 모든 요청을 Burp 또는 다른 터널을 통해 프록시할 수 있습니다. 첫 단계 example.app-settings.conf 파일의 이름을 app-settings.conf 로 변경하고 설정을 조정하세요. 기본적으로 바로 작동해야 하지만, 대상에 따라 청크 크기를 조정하는 것이 좋습니다. 실행 이 도구는 CLI를 통해 인수를...

5.9AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/26 6:30 a.m.•11 views

PyFlooder

PyFlooder 通常のWebサイトを10秒で停止させることができるHTTP Flood Pythonスクリプトです どのように動作しますか? 設定可能な数のランダムなGETリクエストを生成し、ターゲットに送信します 使用方法 root@kitploit: pyflooder.py...

6AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 9:54 p.m.•7 views

SQLi_Sleeps

SQLiSleeps time-basedインジェクションにより応答時間を20秒以上にすることで、SQLiの脆弱性を発見できるシンプルなスクリプトです。 root@kitploit: usage: SQLiSleeps2.py -h -u URLS -d DATA -c COOKIE Realiza una petición GET a múltiples URLs con diferentes datos. options: -h, --help show this help message and exit -u URLS, --urls URLS Archivo de texto...

6.1AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 9:43 a.m.•11 views

http-protocol-exfil

http-protocol-exfil HTTP 프로토콜 버전을 사용하여 파일을 비트 단위로 보냅니다"HTTP/1.0"은 0, "HTTP/1.1"은 1을 나타냅니다. GET 요청을 사용하므로 Blue Team은 IP 주소로의 요청만 보게 됩니다. 그러나 큰 파일을 보내는 데 시간이 오래 걸립니다. 예를 들어 200KB를 보내는 데 1시간이 필요하며, 요청 수는 파일 바이트 수의 8배로 매우 많아집니다. 리스너 생성 리스너를 실행하려면 listener.py를 사용하고, 선택적 인자로 수신할 포트를 지정합니다. root@kitploi...

6AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 9:12 a.m.•9 views

MalleableC2Profiles

MalleableC2Profiles Cobalt Strike 3.6+ 用の Malleable C2 プロファイル bingsearchgetonly.profile - Bing Web 検索プロファイル、GET リクエストのみ使用 cnnvideogetonly.profile - MSNBC ライブビデオストリーミングプロファイル、GET リクエストのみ使用 googledrivegetonly.profile - Google ドライブのドキュメントビューアプロファイル、GET リクエストのみ使用 microsoftupdategetonly.profile -...

5.9AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/25 6:18 a.m.•8 views

HttpStrike

HttpStrike Pythonで書かれた高速なDDoSスクリプトです。リクエスト数を好きなだけ増やせば、大量のGETリクエストを送信します。...

5.9AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 3:09 p.m.•12 views

CVE-2026-33340

CVE-2026-33340: lollms-webui における SSRF 概要 フィールド| 詳細 ---|--- CVE ID| CVE-2026-33340 脆弱性| サーバーサイドリクエストフォージェリ SSRF 影響を受ける製品| ParisNeo/lollms-webui LoLLMs WEBUI 深刻度| 緊急 — CVSS 9.1 CVSS ベクター| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918: サーバーサイドリクエストフォージェリ SSRF 影響を受けるコンポーネント|...

9.1CVSS6.2AI score0.01662EPSS
SaveExploits3References5
Kitploit
Kitploit
•added 2026/09/22 9:39 a.m.•13 views

log4j-scan

1 使用方法 CVE-2021-44228 log4j 2.x RCE脆弱性検出ツール。対象URLにGETリクエストを送信し、dnslogを使用して応答の有無を確認します。 root@kitploit: $ python3 log4j-scan.py -h Usage: python log4j-scan.py -u Options: -h, --help このヘルプメッセージを表示して終了 -u URL, --url=URL 検査対象のURLを入力(例: https://ainrm.cn) 2 実行画面 1...

10CVSS7.5AI score0.99999EPSS
SaveExploits375
BDU FSTEC
BDU FSTEC
•added 2026/09/18 12:00 a.m.•6 views

The vulnerability of Tenda FH303 and A300 router microprogramming software is related to deficiencies in cookie file processing, which allows attackers to perform spoofing attacks.

The vulnerability of Tenda FH303, A300 router microprogramming software is related to deficiencies in cookie file processing. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks by sending specially crafted GET requests to the /goform/AdvSetDns endpoint...

10CVSS6.6AI score0.00651EPSS
SaveExploits1References3Affected Software2
CVE
CVE
•added 2026/09/17 10:04 p.m.•19 views

CVE-2026-54642

CubeCart (ecommerce software) versions prior to 6.7.5 contain a CSRF vulnerability in the admin panel. The reset_id (download-counter reset) and delete_card (stored payment-card deletion) actions in admin/sources/orders.index.inc.php use state-changing GET requests that are omitted from the CSRF ...

5.3CVSS5.8AI score0.00325EPSS
SaveExploits0References4
EUVD
EUVD
•added 2026/09/17 10:04 p.m.•13 views

EUVD-2026-82530

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

5.3CVSS5.8AI score0.00325EPSS
SaveExploits0References4
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/16 12:00 a.m.•0 views

CVE-2026-92569: Server-Side Request Forgery (SSRF)

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

5.3CVSS6AI score0.00342EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/15 11:35 a.m.•9 views

EUVD-2026-78434

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

7.1CVSS5.7AI score0.00415EPSS
SaveExploits0References5
CVE
CVE
•added 2026/09/15 11:35 a.m.•17 views

CVE-2026-91994

Semaphore UI through 2.19.12 contains a missing authorization vulnerability in the GetMustCanMiddleware component. The middleware exempts GET and HEAD requests from project resource permission checks, allowing attackers with guest or task_runner roles to read all project environments—including pl...

7.1CVSS5.7AI score0.00415EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/15 12:00 a.m.•19 views

PT-2026-91934

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment...

7.1CVSS5.7AI score0.00415EPSS
SaveExploits0References6
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/15 12:00 a.m.•2 views

CVE-2026-91994: Missing Authorization

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

7.1CVSS5.8AI score0.00415EPSS
SaveExploits0References2
AstraLinux
AstraLinux
•added 2026/09/14 12:01 p.m.•9 views

Astra Linux – Vulnerability in Batik

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests...

8.2CVSS6.8AI score0.1328EPSS
SaveExploits0References1
AstraLinux
AstraLinux
•added 2026/09/14 12:01 p.m.•6 views

Astra Linux – Vulnerability in ffmpeg, ffmpeg5

A flaw was discovered in FFmpeg’s DASH playlist support. This vulnerability allows for arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg, through a crafted DASH playlist containing malicious URLs...

7.2CVSS6.8AI score0.00376EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/08 4:18 p.m.•5 views

CVE-2026-86718

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

7.1CVSS0.00196EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/09/04 5:54 p.m.•7 views

CVE-2026-53760 Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

5.2CVSS5.7AI score0.00167EPSS
SaveExploits0References2
Rows per page
Query Builder