internal-security-detect

Internal Security Detection via Safebase Los portales SafeBase expuestos atienden a dos públicos a la vez: prospectos que necesitan pruebas de tu postura de seguridad e investigadores de seguridad equipos azul y rojo. Cada marca verde revela un control que supuestamente existe hoy; cada marca...

ida-cli

ida-cli CLI de IDA sin interfaz gráfica y kit de herramientas centrado en skills para el análisis de binarios en macOS y Linux. ida-cli selecciona automáticamente un backend de runtime, inicia automáticamente un servidor local cuando es necesario y expone la misma superficie como un CLI plano, un...

acropalypse-reconstructor

Acropalypse CLI Multi-Tool Un script Python ligero y sin interfaz gráfica headless diseñado para detectar y reconstruir imágenes recortadas vulnerables a la vulnerabilidad Acropalypse CVE-2023-21036 para Google Pixel Markup y CVE-2023-28303 para la Herramienta de Recortes de Windows. Esta...

vi-bot

BotDetect v2 — Librería de Detección de Bots en Producción Librería de detección de bots y automatización del lado del cliente con puntuación ponderada, análisis de comportamiento, huella digital del navegador y umbrales configurables. Detecta navegadores sin cabeza, Selenium, Puppeteer,...

asn-search

asn-search 该工具将使用Hurricane Electric转储ASN信息。 该工具运行在Docker上，你可以使用我已经创建好的镜像： root@kitploit: docker run -it --cap-add=SYSADMIN tuxotron/asn-search 或者你可以自己构建： root@kitploit: docker build -t asn-search . docker run -it --cap-add=SYSADMIN asn-search 示例： root@kitploit: docker run -it --cap-add=SYSADMIN...

PacketPirate

PacketPirate Un proxy MITM sin interfaz gráfica, programable y basado en la línea de comandos, diseñado para la interceptación, análisis y modificación de tráfico de red en sistemas Windows. Funciona de manera similar a los proxies GUI estándar de la industria, pero está optimizado para entornos ...

cobaltstrike-headless

Headless Strike Aggressorscript que convierte el cliente headless de Aggressor en un cliente de Cobalt Strike mayormente funcional. Uso conéctate a tu teamserver mediante la utilidad headless aggressor integrada ./agscript root@kitploit: ./agscript host port user password carga el archivo .cna...

CVE-2023-24278

CVE-2023-24278 - Squidex 中的反射型 XSS 漏洞 概述 CVE ID: CVE-2023-24278 受影响产品: Squidex 7.4.0 之前的所有版本 报告者: Ioannis Christodoulakos 本仓库提供了关于 Squidex 开源无头 CMS 软件中发现的两个反射型跨站脚本（XSS）漏洞的信息及利用方式。这些漏洞影响 7.4.0 之前的所有版本，攻击者可通过向 /squid.svg 端点的特定查询参数中注入代码，在受害者浏览器中执行恶意 JavaScript 代码。 漏洞详情 漏洞是由于 /squid.svg 端点的 text 和...

react2shell-checker

React2Shell 检查器 用于检测 Next.js 和 React 应用程序中 React2Shell 漏洞 CVE-2025-55182 的安全漏洞扫描器。 概述 React2Shell 检查器允许您扫描网站，检测它们是否运行存在漏洞的 Next.js 或 React Server Components 版本。该工具使用无头浏览器技术检测框架版本，并将其与已知的受影响版本范围进行比较。 功能特性 🔍 自动检测 — 通过基于浏览器的分析检测 Next.js 和 React 版本 ⚠️ 漏洞评估 — 对照官方受影响版本列表进行检查 📋 详细报告 — 显示框架、版本、严重性和修复步骤 🔗...

CVE-2026-63472

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presente...

CVE-2026-63461

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden...

CVE-2026-63461 Vendure: Shop API list queries can return non-public entities when filterOperator is OR

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine mandatory visibility guards with caller-supplied filters using the caller-controlled filterOperator. When filterOperator is OR, a predicate matching a hidden...

CVE-2026-62108

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-62108 WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

EUVD-2026-81491

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-62108

CVE-2026-62108 is an unauthenticated Broken Authentication vulnerability in the Headless Single Sign On WordPress plugin, affecting versions 1.7.0 and earlier . Discovered by Joost Grunwald and scored 9.8 (CRITICAL) via CVSS 3.1 (network vector, no privileges or user interaction required, high im...

CVE-2026-62108 WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-62108: Authentication Bypass by Spoofing

Unauthenticated Broken Authentication in Headless Single Sign On = 1.7.0 versions...

CVE-2026-56831 Shopper: Negative discount values accepted and propagated through order calculation pipeline

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixedamount discount values, persists them in shdiscounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and...

WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Joost Grunwald in WordPress Plugin Headless Single Sign On versions = 1.7.0...