CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom

CVE-2026-31280-Insecure-Bluetooth-RFCOMM-Leading-to-Device-Crash-in-Parani-M10-Intercom A Bluetooth Classic RFCOMM service of Parani M10 Intercom is exposed without enforcing secure authentication or proper access control. Once within range, any device can Establish a connection without proper...

CVE-2023-48022

CVE-2023-48022 CVE-2023-48022 exploit modified from Bishop Fox work How to use set ip and port in jobs.py set payload in malicious.py $ pip install ray $ python3 jobs.py...

Dropper-GCleaner-C2-Infrastructure-Kernel-Driver-PowerShell-Conhost-Payload-Analysis

1. C2 Infrastructure – Resilient & Redundant Servers Process Hacker memory analysis reveals a comprehensive list of domains used by Dropper GCleaner for C2 communication. These domains are hosted on various platforms Scaleway, Render, Replit, etc., indicating a robust and redundant infrastructure...

CVE-2026-93785 cifs: validate idmap key payload length

In the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret...

MaldevAcademyLdr.2

MaldevAcademyLdr.2: RunPE implementation with multiple evasive techniques Quick Links Maldev Academy Home Maldev Academy Syllabus Maldev Academy Pricing !NOTE Although this repo can be used to execute other binaries, the whole focus was on running the mimikatz.exe executable. This is for...

CVE-2026-67595

CVE-2026-67595 — Embedded Malicious JavaScript in VaahCMS Security advisory for CVE-2026-67595 : an obfuscated JavaScript spyware payload shipped inside the official releases of VaahCMS a supply-chain / embedded-malicious-code issue, independently discovered and reported by Ilhomjon Rustamov...

log4j-payload-generator

0x01 Introduction log4j-payload-generator is a woodpecker framework plugin for generating log4j JNDI injection vulnerability payloads. It can currently generate the following 5 types of payloads with one click. 1. Raw payload 2. upper|lower:x type randomly mixed payload 3. upper|lower:x fully...

ufuzz

UFuzz, or Universal Plug and Fuzz, is an automatic UPnP fuzzing tool. It will enumerate all UPnP endpoints on the network, find the available services and fuzz them. It also has the capability to fuzz HTTP using Burp proxy logs. It is designed to fuzz embedded systems, and as such, is only single...

L4sh

Log4Shell RCE Exploit fully independent exploit does not require any 3rd party binaries. The exploit spraying the payload to all possible logged HTTP Headers such as X-Forwarding , Server-IP , User-Agent Usage root@kitploit: python main.py -i lhost -u http://target:targetport -c "commandtoexecute...

phpggc

PHPGGC: Cadenas de Gadgets Genéricas de PHP PHPGGC es una librería de payloads de unserialize junto con una herramienta para generarlos, desde la línea de comandos o programáticamente. Cuando te encuentras con un unserialize en un sitio web del que no tienes el código, o simplemente cuando intent...

bro-shellshock

ShellShock Detector for Bro This script detects successful exploitation of the Bash vulnerability with CVE-2014-6271 nicknamed "ShellShock". It's more comprehensive than most of the detections around in that it's watching for behavior from the attacked host that might indicate successful compromi...

SSTI-Exploit-Detector

SSTI-Exploit-Detector SSTI Exploit Detector is a tool designed to detect potential Server-Side Template Injection SSTI vulnerabilities in web applications. SSTI-Exploit-Detector Jenderal92 Features Custom Payload File : Allows users to add their own payloads to test various template engines...

Automated-blind-xss-search-for-Burp-Suite

Femida-xss WIP An automated blind-xss search plugin for Burp Suite. Installation Git clone https://github.com/ianxtianxt/Automated-blind-xss-search-for-Burp-Suite.git Burp - Extender - Add - find and select blind-xss.py How to use Settings First of all you need to setup your callback URL in field...

RCE-Exploit-Framework

RCE-Exploit-Framework This framework is designed to assist penetration testers or developers in understanding the mechanics of remote code execution RCE exploitation. Features Payload Generator : Supports the creation of custom payloads based on Python, Bash, and PHP. Exploit Executor : Delivers...

CVE-2026-20841

CVE-2026-20841 PoC PoC of the "Windows Notepad RCE" vulnerability. Disclaimers 1. I am NOT the one who discovered this vulnerability. Props to the original authors listed on the official disclosure page. I just recreated the PoC according to the description. 2. I personally don't think this...

CVE-2019-0567-MS-Edge

CVE-2019-0567-MS-Edge POC A Proof a concept for MS Edge in as an exercise to learn browser exploiting and migrations that are presented on the Windows 10 machine. All code were created by Connor McGarr and edited to work on Windows 10 build 15063.483. shell2js.py My personal script to convert...

Log4jTools

Log4jTools Tools for investigating Log4j CVE-2021-44228 Bug explanation and Demo https://www.youtube.com/watch?v=0-abhd-CLwQ FetchPayload.py Get java payload from ldap path provided in JNDI lookup. Requirements: curl system, requests python Example command: root@kitploit: python FetchPayload.py...

CVE-2025-55182-exploit

CVE-2025-55182 Exploit This repository contains a simple exploit for CVE-2025-55182 , a critical remote code execution vulnerability in React Server Components. Vulnerability Overview CVE-2025-55182 is an unauthenticated remote code execution vulnerability in React Server Components CVSS 10.0. Th...

0-click-RCE-Exploit-for-CVE-2024-51791

CVE-2024-51791 / 0-Click RCE Exploit Author: Joshua Provoste https://x.com/JoshuaProvoste/status/1858910306140893268 This repository contains a proof-of-concept exploit for CVE-2024-51791, an unauthenticated arbitrary file upload vulnerability in a vulnerable WordPress forms plugin, leading to...

WhatsRCE

WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? root@kitploit: sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRC...