CVE-2022-24816

CVE-2022-24816 スクリプトの使用方法 前提条件 1. リポジトリをクローンする : root@kitploit: git clone https://github.com/c1ph3rbyt3/CVE-2022-24816.git cd CVE-2022-24816 2. 依存関係をインストールする : Python 3 がインストールされていることを確認してください。次に、以下のコマンドを実行して必要な依存関係をインストールします: root@kitploit: pip install -r requirements.txt requirements.txt...

KubeStalk

KubeStalk KubeStalk is a tool to discover Kubernetes and related infrastructure based attack surface from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around the internet during Project Resonance - Wave 9. Usage The GIF belo...

gitGRAB

gitGRAB Requests のインストール root@kitploit: pip install requests プログラムの実行 root@kitploit: python3 gitgrab.py...

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

Strapi-CVE-2019-1881

Strapi-CVE-2019-1881（Kynda 作） 1. pip install requests 2. python3 exploit.py :...

CVE-2026-2020-SSRF-via-URL-Parser-Differential

CVE-2026-2020 – URLパーサー差分によるSSRF プログラムコード（Python） root@kitploit: vulnerableservice.py - Validates URL with urllib.parse, fetches with requests from flask import Flask, request import requests import urllib.parse app = Flaskname def isallowedurlurl: parsed = urllib.parse.urlparseurl Only allow...

CVE-2026-25645

CVE-2026-25645 requests.utils.extractzippedpaths における安全でない一時ファイルの再利用 エグゼクティブサマリー Python の requests ライブラリにおいて、公開ユーティリティ関数 requests.utils.extractzippedpaths に脆弱性が確認されました。この関数は、システムの一時ディレクトリ /tmp にファイルを展開しようとする際に、予測可能で一意でないファイル名を使用しており、既存ファイルの整合性や所有権を検証していません。 requests と certifi を組み合わせたデフォルトの動作は...

scanless

⚠️ I am no longer maintaining scanless as of August 2023. ⚠️ scanless This is a Python command-line utility and library for using websites that can perform port scans on your behalf. Supported Online Port Scanners ipfingerprints spiderip standingtech viewdns yougetsignal Install Do it up:...

CVE-2018-18820

CVE-2018-18820 Icecastサーバー向けCVE-2018-18820チェッカー 追加情報は必要ありません。すべてのコンテキストはmain.pyファイル内にあります。 必要なのはrequestsライブラリだけで、これは誰もが既に持っているものです。...

CVE-2022-1592

CVE-2022-1592 POC root@kitploit: pip install requests --break-system-packages root@kitploit: CVE-2022-1592.py https://tatget.com/...

Astra Linux – Vulnerability in requests

The Requests library is an HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function used a predictable filename when extracting files from zip archives into the system’s temporary directory. If the target file already existed, it was reused without validation....

Astra Linux – Vulnerability in requests

Requests is an HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This issue arises due to the way we use rebuildproxies to reattach the Proxy-Authorization header to requests. For HTTP connections...

CVE-2026-75898

RAGFlow before 0.26.3 lacks URL validation in the agent Invoke component (agent/component/invoke.py), allowing low-privilege users to force the server to fetch internal metadata endpoints and return responses. Patch is available in v0.26.3. Exploitation details are not provided in the documents.

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2754)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename whe...

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit...

PYSEC-2026-2950 PraisonAI has an SSRF bypass

Summary The URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current PraisonAI project uses validateurl to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - Monitor Component uses WebSphere Application Server Liberty which could provide weaker than expected security, is affected by a privilege escalation vulnerability and server-side request forgery, requests-2.32.4-py3-none-any.whl which are vulnerable to...

PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs

Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Workarounds For older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session docs. References...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-25645 DESCRIPTION: Requests is a HTTP library...