Dirty-Vanity

Dirty Vanity A POC for the new injection technique, abusing windows fork API to evade EDRs. Usage DirtyVanity.exe TARGETPIDTOREFLECT Runtime steps Allocate and write shellcode to TARGETPIDTOREFLECT Fork TARGETPIDTOREFLECT to a new process Set the forked process's start address to the cloned...

Dragnmove

Dragnmove Dragnmove is a post-exploitaition tool that infects files shared between users in order to move from one system to another. Dragnmove can detect actions like dropping a file into the browser window or attaching a file to an email client. After Dragnmove detects the action, it hooks...

linux_injector

linuxinjector A simple ptrace-less shared library injector for x64 Linux. Usage linuxinjector mode 1. normal dlopen 2. memfd + dlopen for injecting into containers 3. raw shellcode pid Target process id. Must have ptrace rights to it required for accessing /proc/$pid/mem. Not ptraced, so another...

CVE-2025-29927

CVE-2025-29927 Reproduction and fix of the CVE-2025-29927 vulnerability. root@kitploit: git clone [email protected]:Bongni/CVE-2025-29927.git cd CVE-2025-29927 In vulnerable/ there is a version of the application that is vulnerable to the attack. In fixed/ there is a version of the applicati...

CVE-2026-77263

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via comment content in all versions up to and including 3.13.4 . The root cause is insufficient input sanitization and output escaping: an attacke...

EUVD-2026-71844

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77233

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin is affected by an unauthenticated Stored Cross-Site Scripting (XSS) via Comment Content via AdSense Regex Rewrite in all versions up to and including 3.13.4 . The root cause is insufficient input sanitizati...

EUVD-2026-71841

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2026-71839

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

CVE-2026-83627

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress (versions ≤ 3.21.0 ) is vulnerable to unauthenticated remote code execution via a flaw in the page cache debug log. The protective

CobaltWhispers

CobaltWhispers Author: @Cerbersec CobaltWhispers is an aggressor script that utilizes a collection of Beacon Object Files for Cobalt Strike to perform process injection, persistence and more, leveraging direct syscalls to bypass EDR/AV. CobaltWhispers is powered by SysWhispers2 and InlineWhispers...

wp2shell-poc-fulljs

WordPress CVE Logical Flow Demonstration Overview This project allows to reproduce the logical flow related to CVE-2026-63030 and CVE-2026-60137 leading to an sql injection serving as a base to finally trigger a RCE in WordPress. CVE-2026-63030 CVE-2026-60137 The demonstration illustrates how the...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2023-26469-Jorani

CVE-2023-26469 Exploitation Tool Overview This is a Proof of Concept PoC exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques. ⚠️ Warning: This tool is intended for security research and authorized testing only...

CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Stored Cross-Site Scripting XSS in Perfex CRM Chatbot ⚠️ Security Advisory A critical Stored Cross-Site Scripting vulnerability in Perfex CRM's chatbot feature 📋 Overview A stored cross-site scripting XSS vulnerability in the chatbot component of Perfex CRM, prior to...

CVE-2025-56380

CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...

EUVD-2026-71823

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

In libxml2 versions before 2.15.4 , the functions xmlXIncludeProcess and xmlXIncludeProcessTree in the xinclude module fail to propagate parseFlags (such as XML_PARSE_NONET) to subsequent XInclude processing. When an application uses a custom resource loader, this can allow network access even wh...

llm-differential-privacy-gateway

Noisegate: a differential-privacy gateway for untrusted AI agents An AI agent that can study sensitive data without being able to single anyone out. The limit is mathematical, it's enforced in code the agent can't reach, and the repo ships the attacks that try to break it. A recorded Claude Deskt...