Max

ब्लडहाउंड का अधिकतम लाभ उठाना: एक सरल टूल सूट विवरण नया रिलीज़: dpat - ब्लडहाउंड डोमेन पासवर्ड ऑडिट टूल DPAT एक सरल टूल सूट: get-info - Neo4j डेटाबेस से जानकारी की सूचियाँ खींचें mark-owned - वस्तुओं की एक सूची को स्वामित्व के रूप में चिह्नित करें mark-hvt - वस्तुओं की एक सूची को उच्च मूल्य...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. id: CVE-2026-38361 info: name:...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

DirtyPipe-BSI

Dirty...क्या? यह Max Kellermann द्वारा Dirty Pipe के लिए प्रूफ ऑफ कॉन्सेप्ट है, लेकिन इसे /etc/passwd में root के पासवर्ड फ़ील्ड को ओवरराइट करने और root शेल प्राप्त करने के बाद इसे पुनर्स्थापित करने के लिए संशोधित किया गया है। नोट: मैं इस भेद्यता को खोजने या प्रूफ ऑफ कॉन्सेप्ट लिखने का कोई श्रेय...

dcrawl

dcrawl dcrawl is a simple, but smart, multi-threaded web crawler for randomly gathering huge lists of unique domain names. How it works? dcrawl takes one site URL as input and detects all links in the site's body. Each found link is put into the queue. Successively, each queued link is crawled in...

duplicut

Duplicut :scissors: Quickly dedupe massive wordlists, without changing the order...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

bscan

:mag: an asynchronous target enumeration tool :magright: Synopsis bscan is a command-line utility to perform active information gathering and service enumeration. At its core, bscan asynchronously spawns processes of well-known scanning utilities, repurposing scan results into highlighted console...

CVE-2022-0847

DirtyPipe استغلال لثغرة DirtyPipe، كتبه واكتشفه Max Kellermann - https://dirtypipe.cm4all.com/ POC...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

pgm-attack

PGM-attack Обзор Официальный код для нашей статьи Poisoning Attacks on the PGM-index. Быстрый старт 1. Клонирование и подмодули root@kitploit: git clone REPOSITORY LINK cd pgm-index-poisoning git submodule update --init --recursive 2. Сборка root@kitploit: ./scripts/build.sh Требуется CMake см...

EUVD-2026-42049

Phoenix: Unbounded channel joins per transport enables DoS over few connections...

GhostLock-5.10

GhostLock 5.10 This is a kernel root exploit for the Amazon Fire Max 11 sunstone and the Fire TV Stick 4K Max 2nd Gen / 2023 karat, adapted from CVE-2026-43499 in CyberMeowfia. Supported devices Two devices are supported, both on Fire OS 8. Each has its own build target. Fire Max 11 sunstone Fire...

CVE-2023-44487

HTTP2 रैपिड रीसेट अटैक: CVE-2023-44487 रैपिड रीसेट अटैक CVE-2023-44487 का परीक्षण करने के लिए त्वरित शोषण। नोट: केवल शैक्षिक उद्देश्य के लिए शोषण: रैपिड रीसेट अटैक CVE-2023-44487 का परीक्षण करने के लिए त्वरित शोषण। नोट: केवल शैक्षिक उद्देश्य के लिए विषय सूची स्थापना उपयोग स्थापना Git का उपयोग करक...

CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2023-41993

CVE-2023-41993 PoC d'Exploitation Ce dépôt contient un exploit de type Preuve de Concept PoC pour la vulnérabilité CVE-2023-41993. Ce PoC démontre des primitives limitées de lecture/écriture basées sur le PoC publié par po6ix. Une démo de ce PoC peut être trouvée ici. Veuillez créer une issue si...

Rejetto HTTP File Server - Template injection

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. id: CVE-2024-23692 info: name: Rejetto HTTP File Server - Template injection author: johnk3r severity: critical description: | This...

Autodesk 3ds Max 2026.x < 2026.3.4 / 2027.x < 2027.2.0 Multiple Vulnerabilities (ADSK-SA-2026-0014)

The version of Autodesk 3ds Max installed on the remote Windows host is 2026.x prior to 2026.3.4, or 2027.x prior to 2027.2.0. It is, therefore, affected by multiple vulnerabilities: - A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerabilit...

SUSE CVE-2026-79921

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...

bind: bind9: Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the...