buster

Description Buster is an advanced OSINT tool used to: Get social accounts of an email using multiple sourcesgravatar,about.me,myspace,skype,github,linkedin,previous breaches Get links to where the email was found using google,twitter,darksearch and paste sites Get breaches of an email Get domains...

immich-exfiltration-demo

Cybersecurity demo: Immich exfiltration CVE-2026-35455 Demo di cybersecurity come prova di concetto per CVE-2026-35455, che mostra la generazione automatica di chiavi API e l'esfiltrazione di dati, portando al completo dirottamento dell'account e all'accesso non autorizzato persistente. Scopri di...

CVE-2026-29000-PoC

CVE-2026-29000 — Prova de Conceito de Bypass de Autenticação do JwtAuthenticator do pac4j-jwt Uma prova de conceito para CVE-2026-29000 , um bypass de autenticação no componente pac4j-jwt JwtAuthenticator CVSS 10.0 , Crítico. O script forja um token que se passa por qualquer usuário com qualquer...

CVE-2020-10560-Key-Recovery

CVE-2020-10560 Recupero della chiave AES Questa PoC recupera la sitekey per OSSN 5.3 e versioni successive. Per maggiori informazioni vedere http://techanarchy.net/blog/cve-2020-10560-ossn-arbitrary-file-read...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

Gladinet CentreStack < 16.4.10315.56368 Use of Hard-coded Key Leads to Unauthenticated RCE

Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

mitigate-folina

mitigate-folina Mitiga il "Folina"-ZeroDay CVE-2022-30190 e l'incubo "Search" nessun CVE fornito al momento Questo script eseguirà il backup e poi rimuoverà la chiave di registro interessata come suggerito da Microsoft per mitigare CVE-2022-30190. Se parametrizzato con "-revert", lo script...

CVE-2023-32784

keepass-dump-masterkey Utilizzo python3 poc.py Anteprima Come promemoria, il primo carattere non può essere trovato nel dump, e per il secondo lo script ti darà solo alcune possibilità, in ogni caso ti consigliamo di eseguire il bruteforce su 2 caratteri con lo script qui sotto root@kitploit:...

Malicious code in desmoshomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fae975f53feac57fc6aec90279e55e994d6e61d177217b012dfb59c6f42a7e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ilovedesmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efb46da64ab0f3eaee41abecec08214a4af0f228c701fd39ad711c0ae124927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosclasswork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d435d8cefda2b58ca65ad06ffac8521a26ccb991dd4828dd479e64ddb38bb865 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

EUVD-2026-65298

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor यह पायथन फ़ाइल hikvision कैमरों द्वारा उपयोग किए जाने वाले configurationFile को डिक्रिप्ट करेगी जो CVE-2017-7921 के लिए संवेदनशील हैं। https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ विवरण Hikvision IP कैमरा प्रमाणीकरण...

CVE-2025-53694

CVE-2025-53694: Divulgação de Informações na API ItemService com um usuário anônimo restrito, levando à exposição de chaves de cache usando uma abordagem de força bruta A API ItemService, acessível em /sitecore/shell/api/sitecore/ItemService/GetChildren, permite que usuários não autenticados...

bitlocker-bypass-research

Ricerca sul Bypass di BitLocker Progetto personale di ricerca sulla sicurezza — bypass della crittografia integrale del disco di BitLocker tramite CVE-2023-21563 BitPixie. Di cosa si tratta Ad ottobre 2025 ho effettuato una valutazione fisica di recupero su un laptop aziendale con BitLocker attiv...

CVE-2026-4444-JWT-Algorithm-Confusion-via-kid-Injection

CVE-2026-4444 – Confusão de Algoritmo JWT via Injeção de kid Código do Programa servidor Node.js + exploit Python root@kitploit: // jwtserver.js - Vulnerable JWT verification server const express = require'express'; const jwt = require'jsonwebtoken'; const jwksClient = require'jwks-rsa'; const...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Side-Channel temporale del KEM post-quantistico decapsulazione Kyber Panoramica Un'implementazione vulnerabile della decapsulazione del KEM Kyber perde bit della chiave segreta attraverso differenze di temporizzazione nella fase di rifiuto del ciphertext, consentendo il recuper...

solarflare

solarflare Credential Dumping Tool for SolarWinds Orion Blog post: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Credit to @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI. root@kitploit: ============================================...