CVE-2026-46439

A flaw was found in compliance-trestle. This Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command, which recursively evaluates rendered templates. An attacker can inject malicious payloads into data fields, such as SSP documents or Lookup Tables, to achieve...

Automated-blind-xss-search-for-Burp-Suite

Femida-xss WIP Ein automatisiertes Blind-XSS-Such-Plugin für Burp Suite. Installation Git clone https://github.com/ianxtianxt/Automated-blind-xss-search-for-Burp-Suite.git Burp - Extender - Add - blind-xss.py finden und auswählen Verwendung Einstellungen Zuerst musst du deine Callback-URL in das...

Advanced-Loader-Reverse-Engineering

Da Shellhost a 3 DLL: Analisi di un Loader Avanzato con Iniezione di Payload, Bypass di CFG e Attacchi di Downgrade Panoramica Questa analisi copre un loader sofisticato multi-fase che prende di mira Shellhost.exe, amsi.dll, mstscax.dll e clbcatq.dll. Il loader utilizza module stomping, bypass di...

modrosnlr5

🧬 modrosnlr5 – Linux-Kernel-LPE-PoC CVE-2026-31431 Proof-of-Concept-Tool zur Validierung der Ausnutzung der Schwachstelle CVE-2026-31431 auf Linux-Systemen. Der Exploit nutzt die AFALG-Socket-Schnittstelle des Kernels, um eine Nutzlast zu injizieren und aus einer Benutzersitzung ohne Berechtigung...

Citrix_Secure_Access_LPE_0DAY

Citric Secure Access Escalation locale dei privilegi Ho scoperto una vulnerabilità di escalation locale dei privilegi nel client Windows Citrix Secure Access. Questa vulnerabilità consente a un amministratore privilegiato di iniettare un payload dannoso per ottenere i privilegi di NT Authority. L...

NXLoader

NXLoader Lancia i payload Fusée Gelée da Android stock. Scarica il file APK qui Basato pesantemente su Fusée Gelée e ShofEL2. fusee.bin è incluso come payload predefinito. Nota: Qualsiasi payload proprietario non è né testato né supportato da questo software. Funziona sul tuo dispositivo? Per...

Egyscan

EgyScan V3.4 "Ultra" : La tua fortezza digitale dell'invincibilità 🏰 Saluti, Guardiani del Regno Digitale! 🛡️ Preparati a intraprendere un viaggio straordinario con EgyScan V3.0 , la sentinella definitiva che trasforma i tuoi siti web in fortezze inespugnabili contro le incessanti minacce...

domdig

DOMDig DOMDig è uno scanner DOM XSS che viene eseguito all'interno del browser web Chromium e può scansionare applicazioni a pagina singola SPA in modo ricorsivo. A differenza di altri scanner, DOMDig può analizzare qualsiasi applicazione web inclusa gmail tenendo traccia delle modifiche al DOM e...

CVE-2023-36664

CVE-2023-36664 : Fernausführung von Code in Ghostscript Proof-of-Concept für CVE-2023-36664. Verwendung Um eine Nutzlast in eine .eps-Datei einzufügen: root@kitploit: python3 poc.py -f "filename" --payload "command" python3 poc.py -f file.eps --payload firefox Um eine Reverse-Shell-Nutzlast in ei...

ezXSS

ezXSS ist eine einfache Möglichkeit für Penetrationstester und Bug-Bounty-Jäger, blindes Cross-Site-Scripting zu testen. ezXSS ist ein Tool, das entwickelt wurde, um Cross-Site-Scripting XSS-Schwachstellen zu finden und auszunutzen. Eine der wichtigsten Funktionen von ezXSS ist die Fähigkeit,...

wfuzz

Wfuzz - Il Web Fuzzer Wfuzz è stato creato per facilitare il compito nelle valutazioni delle applicazioni web e si basa su un semplice concetto: sostituisce qualsiasi riferimento alla parola chiave FUZZ con il valore di un dato payload. Un payload in Wfuzz è una fonte di dati. Questo semplice...

CVE-2025-55182-react2shell

react2shell CVE-2025-55182 Toolkit. Scanner + Exploit für unauthorisierte RCE in Next.js via RSC-Payload-Injection. Node.js Exploit: keine Abhängigkeiten. Bash-Scanner: prüft einzelne URLs oder Bulk-Listen. Exploit root@kitploit: Single command with output ./react2shell.mjs -t http://target:3000 ...

CVE-2019-9978

CVE-2019-9978 - Plugin Social Warfare WordPress RCE system'cat /etc/passwd' ✅ Passo 2 – Avviare un Server HTTP Python...

CVE-2014-6287

Rejetto HttpFileServer 2.3.x - Remote-Befehlsausführung CVE-2014-6287 🚨 Über den Exploit Dies ist ein Proof-of-Concept-Exploit für die bekannte Remote-Befehlsausführungsschwachstelle in Rejetto HttpFileServer HFS v2.3.x , identifiziert als CVE-2014-6287. Durch Missbrauch der anfälligen Suchfunkti...

sh4d0wup

sh4d0wup root@kitploit: % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low...

CVE-2026-73657

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, POST /api/v1/runs/:runParam/replay in apps/webapp/app/routes/api.v1.runs.$runParam.replay.ts uses prisma.taskRun.findUnique where: friendlyId: runParam without a...

CVE-2026-24329

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

PT-2026-70054

Name of the Vulnerable Software and Affected Versions wildfly-core affected versions not specified Description An authenticated administrative user can inject a malformed payload into the Inet Address field via the Management Model. This action causes the server to crash and enter an unrecoverabl...

CVE-2026-61453

Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...

PYSEC-2026-2516 Home Assistant has stored XSS in history-graphs

Summary The "remaining charge time"-sensor for mobile phones imported/included from Android Auto it appears is vulnerable to the same issue as CVE-2025-62172. This also indicates that any sensor showing their name in the history-graph, is likely to be vulnerable to this issue. Details Another...