3647 matches found
EQGRP_Lost_in_Translation
EQGRP Lost in Translation Decrypted content of odd.tar.xz.gpg, swift.tar.xz.gpg and windows.tar.xz.gpg Downloaded from https://yadi.sk/d/NJqzpqo3GxZA4 Original post from the ShadowBrokers https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation windows : contains Windows exploits,...
CVE-2026-39047
PrintHack - Printer Security Testing Tool root@kitploit: | | | | | | \ | \ | | | | | | | | | | | | | | | | | ⚠️ DISCLAIMER : This tool is intended for legitimate security testing and educational purposes only. Use responsibly and only on systems you own or have explicit authorization to test. 🎯...
Exploits
Este repositorio contiene una colección personal de CVE de Windows que he convertido en código de exploit, así como una colección de payloads que he escrito para usarse junto con estos exploits. Algunos de estos CVE se han combinado en cadenas de exploits para RCE, escapes de sandbox y escalada d...
CVE-2023-54395 PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...
EUVD-2023-60625
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and...
Fortigate-SSL-VPN-Exploit-Kit
Kit de FortiGate SSL-VPN recuperado en la naturaleza Archivo de investigación. Recuperado tal como se encontró. Yo no escribí estos archivos. Publicado: 1 de septiembre de 2026 Este repositorio es el orquestador, los payloads de segunda etapa y los listeners de operador que se sitúan sobre un...
horrors-log4shell
horrors-log4shell 一个用于 CVE-2021-44228 log4j 的微型实验室（演练场？） 可用于对多个目标执行载荷。 在运行时生成特定目标的载荷。 可调节的配置和绕过方法。 安装 Java相关要求 开发/运行示例 Gradle Maven 为了测试最近的log4j相关漏洞（CVE-2021-44228, CVE-2021-45046）： JDK 8u121 Ysoserial 编译后的 JAR https://github.com/frohoff/ysoserial 确保两边都有兼容的JDK。 Python 依赖 root@kitploit: % pip3...
CVE-2021-44228-Log4j-Payloads
此存储库没有 README。...
Root-My-Galaxy
Root My Galaxy Root My Galaxy 是一个适用于明确受支持的 Samsung 型号与内核组合的一键安装工具。应用程序本身与设备偏移量、原生利用载荷以及 KernelSU 构建产物保持分离。 最新版本 设备源数据与原生载荷由 Root-My-Galaxy-Payloads 维护。 应用程序 该应用会选择型号列表和内核三部分版本号与手机匹配的载荷。例如，6.6.98-android15-8-... 与 6.6.98 匹配。高级模式会同时根据这两个值过滤目录，并允许手动选择，同时显示型号和内核版本警告。 构建 要求： Android Studio JBR 21...
mjet
mjet Mogwai Security Java Management Extensions JMX Exploitation Toolkit mjet es una herramienta que puede utilizarse para proteger servicios JMX configurados de forma insegura. Se basa en el artículo "Exploiting JMX-RMI" de Braden Thomas/Accuvant "http://www.accuvant.com/blog/exploiting-jmx-rmi"...
JavaPayload
JavaPayload JavaPayload is a collection of pure Java payloads to be used for post-exploitation from pure Java exploits or from common misconfigurations like not password protected Tomcat manager or debugger port. Outdated documentation can be found at...
CVE-2025-55182POC
CVE-2025-55182 React Server Components RCE POC 本项目为 CVE-2025-55182 - React Server Components RSC RCE Proof of Concept ，演示在特定条件下可通过 vm.runInThisContext 与 恶意 ACTION payload 触发远程代码执行。 Python 端：自动化发送恶意 ACTION payload 并解析响应 ⚠ 漏洞简介（CVE-2025-55182） React Server Components 的 ACTION payload 在某些条件下会： 被反序列化...
EUVD-2026-70802
MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPFunction where dimension, piece, and degree counts from encoded BHVIPF payloads are used as allocation sizes and loop bounds without validation. Attackers can supply crafted payloads with mismatched dimension values to...
Root-My-Device v0.0.7
Root My Device A fork of BuSung-dev/Root-My-Galaxy, under the Apache License 2.0 — see LICENSE and Credits. Root My Device is a one-click installer for explicitly supported firmware builds. The application itself is kept separate from device offsets, native exploit payloads, and KernelSU build...
grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads
A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service DoS...
CVE-2026-3416
CVE-2026-3416 affects the API Publisher component in multiple WSO2 products. The root cause is the use of a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. Because the PRNG lacks sufficient entropy, a sophisticated attacker with high at...
CVE-2026-84810
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
EUVD-2026-70225
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
CVE-2026-82797
A flaw was found in rlottie. This uncontrolled recursion vulnerability allows a local attacker to cause a denial of service DoS by providing specially crafted serialized data with nested payloads. Successful exploitation requires user interaction to process the malicious data. Mitigation Update...