CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

Security Advisory: Remote Denial of Service via Reachable Assertion in URL Prefix Handling rouille Assigned CVE ID: CVE-2026-66754 Summary Request::removeprefix tests the percent-decoded URL but asserts on the raw one. A request whose decoded path starts with the prefix while its raw path does no...

edge

Cloud edge - Whois for the Cloud Lookup an IP to find the cloud provider and other details based on the provider's published JSON, CSV, or text data Cloud edge is a recon tool focused on exploring cloud service providers. It can be used for cloud attribution and forensics, pentesting, bug bounty,...

text4shell-docker

Install maven - maven-linux 1. Maven install to create the fat jar root@kitploit: mvn clean install 2. Docker build root@kitploit: docker build --tag=text4shell . 3. Docker run root@kitploit: docker run -p 80:8080 text4shell 4. Test the app root@kitploit: http://localhost/text4shell/attack?search...

key-transparency-auditor

key-transparency-auditor A reference implementation of a third-party auditor for Signal's key transparency service, based on the key transparency specification. Overview This service is written in Java using the Micronaut framework. To build and unit test, run root@kitploit: ./mvnw clean test in...

r77-rootkit

r77 Rootkit Rootkit sin archivos de ring 3 r77 es un rootkit de ring 3 que oculta todo: Archivos, directorios Procesos y uso de CPU/GPU Claves y valores del registro Servicios Conexiones TCP y UDP Enlaces, named pipes, tareas programadas Ocultación por prefijo Todo lo que comienza con "$77" está...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

cve-2022-36804

CVE-2022-36804 Bitbucket PoC This repository contains a Python exploit script for Atlassian Bitbucket Server/Data Center vulnerability CVE-2022-36804. The issue is a command-injection flaw in the Git archive flow, where crafted prefix parameters can be interpreted by the server and executed as...

CVE-2026-36851

CVE-2026-36851 Path traversal / arbitrary file read in UnPoller v2.33.0 via the file:// password prefix. File contents are read from disk and transmitted to the configured UniFi controller URL during authentication...

Advance Post Prefix WordPress plugin - Reflected XSS

Advance Post Prefix WordPress plugin through 1.1.1 contains a reflected cross-site scripting caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12734 info: name: Advance...

Traefik - Open Redirect

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-15129 info: name:...

Vite-CVE-2025-30208-EXP

CVE-2025-30208 Detection Tool Vulnerability Analysis CVE-2025-30208 is an arbitrary file read vulnerability in the Vite development server. Attackers can read sensitive server files such as /etc/passwd or C:\windows\win.ini by constructing special paths e.g., @fs prefix. This tool supports...

ShellEvil

ShellEvil Jonatas Fil Dkr Julio Della Flora Thiago Sena THX Struts 2 DefaultActionMapper Interactive Shell Exploit for CVE-2013-225 S2-016 The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed ...

m4ngl3m3

m4ngl3m3! Quick Installation: root@kitploit: $ git clone https://github.com/localh0t/m4ngl3m3 $ cd m4ngl3m3 $ ./main.py Basic Help: root@kitploit: usage: main.py -h -fy FROMYEAR -ty TOYEAR -sy -nf NUMBERSFILE -sf SYMBOLSFILE -cf CUSTOMFILE -sbs -sap -mm MUTATIONMETHODS MUTATIONMODE STRINGSFILE...

CVE-2026-54179 backpack/crud: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.37, the src/app/Library/Uploaders/SingleBase64Image.php methods SingleBase64Image::uploadFiles and...

CVE-2026-54179

CVE-2026-54179 affects backpack/crud , a Laravel package for building admin panels. The SingleBase64Image uploader, bound to image-typed fields via withFiles(), accepts any data URI beginning with data:image without validating the declared MIME subtype or decoded bytes. A related flaw in FileName...

MINI-RH3G-7V5G-XWPP

Bulletin has no description...

CVE-2025-30208

CVE-2025-30208 A PoC del script de explotación para la vulnerabilidad de Lectura Arbitraria de Archivos de Vite /@fs/ Path Traversal en transformMiddleware CVE-2025-30208. Se puede consultar el análisis detallado en este post. Vulnerable en versiones anteriores a : 6.2.3 6.1.2 6.0.12 5.4.15 4.5.1...

BIT-TOMCAT-2026-65182 Apache Tomcat: Bypass longest prefix security constraint

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0 through 11.0.24, from 10.1....

cve-2022-42889-text4shell

Install maven - maven-linux 1. Maven install to create the fat jar root@kitploit: mvn clean install 2. Docker build root@kitploit: docker build --tag=text4shell . 3. Docker run root@kitploit: docker run -p 80:8080 text4shell 4. Test the app root@kitploit: http://localhost/text4shell/attack?search...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...