voron-crypto

Voron crypto/protocol library — request for review This is the crypto and messaging-protocol core of a small E2EE messenger project, pulled out on its own for outside review. It is not the whole product — the Android client and deployment config are intentionally left out; this is just the part...

westone-CVE-2020-14883-scanner

westone-CVE-2020-14883-scanner A remote attacker can construct a special HTTP request to take over the WebLogic Server Console without authentication. Installation & Usage git clone https://github.com/Osyanina/westone-CVE-2020-14883-scanner.git cd westone-CVE-2020-14883-scanner cmd...

CVE-2025-31033

⚠️ CVE-2025-31033 - CSRF in WordPress Buddypress Humanity Plugin = 1.2 🛡️ Vulnerability Summary The Buddypress Humanity plugin for WordPress version = 1.2 is vulnerable to Cross-Site Request Forgery CSRF. This vulnerability allows an attacker to force a higher privileged user e.g., admin to...

Spring4Shell-Python-Firewall-POC

Python Firewall for Spring4Shell CVE-2022-22965 Mitigation 1. Overview This project is a simple but effective firewall implemented as a Proof-of-Concept POC in Python. It's designed to act as an HTTP server that inspects incoming POST requests to detect and block the specific payload pattern...

CVE-2025-55315

CVE-2025-55315 Proof-of-concept exploit for CVE-2025-55315 .NET HTTP Request Smuggling. Demonstrates how improperly parsed chunked encoding lets attackers smuggle requests past proxies and load balancers in vulnerable ASP.NET Core/Kestrel servers. 📊 Presentation View Interactive Prezi Presentatio...

CVE-2026-13465

A stack-based buffer overflow vulnerability exists in the Altera Trusted Firmware on HPS . The root cause is the exploitation of improperly configured or implemented memory protections . This vulnerability affects versions through socfpga_v2.14.0 . The impact includes high integrity and availabil...

CVE-2024-51358

CVE-2024-51358: SSRF in Heimdall application A server-side request forgery SSRF vulnerability was discovered in Heimdall version 2.6.1, specifically within the Add Application feature. This flaw allows remote attackers to perform HTTP requests. References: Heimdall GitHub repository:...

Exploit_CVE-2023-27163

CVE-2023-27163 PoC Exploit Code This Python script is a Proof of Concept PoC for CVE-2023-27163 , a Server-Side Request Forgery SSRF vulnerability in Request Basket. Code Description The script automates the exploitation of CVE-2023-27163. It performs the following actions: 1. Generates a random...

AOSP-DownloadProviderHeadersDumper

AOSP-DownloadProviderHeadersDumper PoC Exploiting Headers Disclosure in Android's Download Provider CVE-2018-9546 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-Request-Headers-Disclosure-CVE-2018-9546.pdf More Information...

CVE-2023-49496_PoC

CVE-2023-49496PoC Description UCServer is an advanced converged communication server. Shanghai Shupin Information Technology Co., Ltd. UCServer has a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive database information. POC root@kitploit: POST...

CVE-2004-0789-DDOS

root@kitploit: sudo python3 exploit.py Enter the DNS server IP address: IP Enter the number of requests to send: NUMBER...

cve-2025-29927

This is a sample Next.js project bootstrapped with create-next-app for practically explaining how cve-2025-29927 works. https://nextjs.org/docs/app/api-reference/cli/create-next-app. Getting Started First, run the development server: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev...

CVE-2024-34958

CVE-2024-34957 idccms CSRF poc CVE-2024-34958 idccms CSRF poc...

Jenkins-CVE-2024-23897-Lab

Jenkins CVE-2024-23897 Lab Arbitrary file read vulnerability in Jenkins 2.441 and earlier. Launch root@kitploit: docker-compose up -d Automated Attack root@kitploit: docker exec -it attacker-host ./auto-exploit.sh Manual Attack root@kitploit: docker exec -it attacker-host bash cd /tmp curl -o...

CVE-2020-14882

CVE-2020-14882 This script enables remote code execution RCE on Oracle WebLogic Server using an unauthenticated GET request. It exploits the vulnerability CVE-2020-14882. By executing arbitrary commands, an attacker can gain unauthorized access to the server. Exploit Details Exploit Title: Oracle...

CVE-2026-67405

A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as usehttpauth=true for Web-STOMP or sslcertlogin=true for both plugins, an attacker can...

CVE-2022-2466---Request-Context-not-terminated-with-GraphQL

CVE-2022-2466 Request-Context-not-terminated-with-GraphQL How to run 1. run mvn:quarkus:dev 2. run the following http requests RUN THIS TWICE root@kitploit: POST http://localhost:8080/graphql Content-Type: application/graphql Authorization: Bearer...

CVE-2025-45250

CVE-2025-45250 Suggested description root@kitploit: MrDoc =0.95 is vulnerable to Server-Side Request Forgery SSRF in the validateurl function of the appdoc/utils.py file. POC root@kitploit: POST /uploaddocimg/ HTTP/1.1 Host: ip:port Accept-Encoding: gzip, deflate DNT: 1 Cookie: your cookie...

CVE-2021-40438

CVE-2021-40438 Requesting a uri-path can cause modproxy to forward the request to an origin server selected by a remote user. This issue affects Apache HTTP Server 2.4.48 and earlier versions. Attackers can exploit this vulnerability by crafting a request with a uri-path, which causes modproxy to...

cve-2026-40072-ssrf-lab

CVE-2026-40072 SSRF Lab Hands-on local lab to demonstrate CVE-2026-40072 in web3.py, show the SSRF impact in Burp Suite, and verify the official fix. Overview This repository contains a safe, local-only proof of concept for CVE-2026-40072, a Server-Side Request Forgery SSRF issue tied to CCIP Rea...