CVE-2021-44142

CVE-2021-44142 Vulnerability Checker A tool to check if a Samba server is vulnerable to CVE-2021-44142 Background CVE-2021-44142 is a heap out-of-bounds read and write in Samba's vfsfruit module used at Pwn2Own Austin 2021 against the Western Digital PR4100. It was first discovered by Nguyễn Hoàn...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

tomcatfileread

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — python3 CVE-2020-1938 CNVD-2020-10487 Tomcat AJP 协议文件读取 / 文件包含漏洞利用 POC 的 python3 转换版 。 原版（python2）作者: ydhcui — https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi 用法 root@kitploit: python3 "Tomcat-ROOT路径下文件包含CVE-2020-1938-python3.py" -...

zstd-jni: zstd-jni: Information disclosure or denial of service via out-of-bounds read

A flaw was found in zstd-jni. This out-of-bounds read vulnerability in the Zstd.getFrameContentSize function occurs because it fails to validate negative srcPosition arguments. A remote attacker can supply negative offset values, bypassing bounds checks and accessing the native frame-header parse...

com.github.luben/zstd-jni: zstd-jni: Denial of Service via out-of-bounds read in ZstdDictDecompress

A flaw was found in zstd-jni. This vulnerability, an out-of-bounds read, occurs in the ZstdDictDecompress constructor due to insufficient validation of offset and length arguments against dictionary array bounds. A remote attacker could exploit this by providing specially crafted input, leading t...

com.github.luben/zstd-jni: zstd-jni: Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect

A flaw was found in zstd-jni. Attackers can exploit this by supplying oversized per-sample lengths to the Zstd.trainFromBufferDirect function, which fails to validate the samples buffer capacity. This allows for reading past buffer boundaries, leading to out-of-bounds memory access and ultimately...

com.github.luben/zstd-jni: zstd-jni: Out-of-bounds read in ZstdDictCompress constructor leads to denial of service

A flaw was found in zstd-jni. This vulnerability occurs due to insufficient validation of offset and length parameters within the ZstdDictCompress constructor. An attacker can exploit this by providing untrusted values, leading to an out-of-bounds memory read. This can result in the disclosure of...

Apache-Solr-Arbitrary-File-Read

Apache Solr Arbitrary File Read Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and client libraries for many programming languages such...

cve-2019-2215

CVE-2019-2215 Pixel 2 和 Pixel 2 XL 的临时 Root（利用 CVE-2019-2215） （基于 Google Project Zero 的 Jann Horn 和 Maddie Stone 的 概念验证） 概述 演示一种仅通过内核内存读/写实现权限提升的攻击，最终获得临时 root shell。 该工具在 Google Pixel 2 / Pixel 2 XL（walleye/taimen）设备上运行，系统镜像为 2019 年 9 月的 QP1A.190711.020，内核版本-BuildID 4.4.177-g83bee1dc48e8 。...

razer-lycosa-kernel-lpe-BYOVD-Vulnerability-PoC

Lycosa.sys, Razer: two kernel vulnerabilities reachable by any local user Discovered through https://github.com/416rehman/DeepZero Vendor: Razer Inc. Component: Lycosa.sys, the Razer Lycosa keyboard filter driver, x64 SHA-256: a120a6184ab16864e8a5f1dfd0cd178fca541de463b5cef946e18c34b9b6f716...

CVE-2026-77578

CVE-2026-77578 — Xibo CMS Arbitrary Local File Read Overview CVE-2026-77578 is an authenticated Arbitrary Local File Read vulnerability in Xibo CMS. An authenticated user with Admin privileges or Module Templates access can import a crafted XML template containing a path-based asset with a...

openfire-ssrf-cve-2019-18394

CVE-2019-18394: Openfire FaviconServlet SSRF Unauthenticated Server-Side Request Forgery in Ignite Realtime Openfire 4.4.2 and earlier admin console, default TCP 9090/9091. Fixed in 4.4.3 issue OF-1885. Request forgery: the host parameter is concatenated into an outbound URL with no validation, s...

cve-2022-31705

CVE-2022-31705 Intro https://www.vmware.com/content/vmware/vmware-published-sites/us/security/advisories/VMSA-2022-0033.html.html Test on windows vmware workstation 16.2.0, with guest os ubuntu server 22 At leat one usb device is be attached to guest machine change the 'qh-field4' in the ehci.c...

geiger

geiger A Geiger counter for AI agents. One read-only command that inventories every AI agent, harness, MCP server, plugin, and AI extension on a machine — and tells you, in plain language, what each one can touch. root@kitploit: npx geiger-scan No install. No account. No telemetry. Reads configs...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: root@kitploit: body="/@vite/client" Hunter search syntax: root@kitploit: web.body="/@vite/client" Ex...

CVE-2024-2961-XXE-Exploit

CVE-2024-2961 CNEXT XXE 通道适配利用脚本 将 Ambionics 官方 cnext-exploits 的 PHP 文件读取 - RCE 利用脚本，适配到 SVG 上传 + XXE 任意文件读取 场景（PolarisCTF 2026 "头像上传器" 一类题目）。 前置条件 目标：Linux + glibc 更新 avatarname - 请求解析接口回显。 2. 过滤器分隔符| - ：XML 实体 URL 中含 时 libxml 解析失败（实测 DOMDocument 返回空文档）； 支持不带前缀的裸过滤器按 分隔，等价于 。...

wpgarlic

wpgarlic Un fuzzer de plugins de WordPress como prueba de concepto que llevó al descubrimiento de más de 300 vulnerabilidades en plugins de WordPress instalados en casi 30 millones de sitios. La técnica utilizada se describe en https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html Si deseas...

CVE-2026-84118-who-labeled-the-crit-as-a-high

CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457 This is one of those where Mozilla labeled a Critical as a High. So someone might want to go have Firefox update the original bug hunters payment if that's the case. THE TLDR: You can do an OOB R primitive on a controlled pointer and the...

CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...

mpDNS

mpDNS también conocido como servidor DNS multipropósito Servidor DNS simple, configurable con múltiples características útiles Python 3 names.db - contiene todos los registros personalizados ver ejemplos Comodines simples como .example.com Captura solicitudes DNS unicode Acciones personalizadas...