111035 matches found
CVE-2026-83545
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
WordPress Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button plugin <= 3.5.9 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by uhcna - vietnam in WordPress Plugin Chaty versions = 3.5.9...
GodPotato-Aggressor-Script
GodPotato-Aggressor-Script GodPotato 由 BeichenDream 编写，可在 https://github.com/BeichenDream/GodPotato 找到。...
HttpStrike
HttpStrike A fast DDoS script written in Python, it will send a lot of get requests if you increase the requests however you please...
EUVD-2026-75967
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...
CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
EUVD-2026-75956
The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...
BIT-TOMCAT-2026-50229 Apache Tomcat: XSS in number guess example
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0...
msiscan
MSI Analyzer This Python script for Linux can analyze Microsoft Windows .msi Installer files and point out potential vulnerabilites. It was developed by Michael Baer @derbaer0 in the SEC Consult Vulnerability Lab. Currently, it is mostly suited for a local privilege escalation also described in o...
postgres-bruteforcer
postgres-bruteforcer About This Go script reads a list of usernames and passwords from a file called creds.txt and tests them against a PostgreSQL database. The script accepts an IP of the PostgreSQL server as a command line argument or a text file of ip's. If an access is granted, the script...
grafana-bruteforce
grafana-bruteforce A tool that takes a combo username and password list and will attempt to bruteforce grafana login page. Grafana will lock you out after 5 attempts so you need to ensure your proxy has multiple external ip's. How to Run Use supplied combo list root@kitploit: python3...
bucket-brute
bucket-brute Aws S3 Tko 工具 root@kitploit: usage: bucket-brute.py -h -u URL -p PROXY -b BUCKET optional arguments: -h, --help show this help message and exit -u URL, --url URL No Such Bucket URL -p PROXY, --proxy PROXY Proxy for debugging -b BUCKET, --bucket BUCKET Bucket Name 示例 root@kitploit:...
magnolia-rce
漏洞标题：Magnolia DX Core 6.3.8 - 命令注入 日期：05/16/2025 漏洞作者：tmrswrr 版本：6.3.8 厂商主页：https://docs.magnolia-cms.com/home/ 产品：https://docs.magnolia-cms.com/product-docs/6.3/releases/release-notes-for-magnolia-cms-6.3.8/ 1. 以管理员身份进行身份验证： https://demoauthor.magnolia-cms.com/.magnolia/admincentral Username:...
CVE-2022-0847
CVE-2022-0847 Simple reproduction of CVE-2022-0847 Original disclosure article: https://dirtypipe.cm4all.com/ Reproduction Environment root@kitploit: Linux kali 5.10.0-kali7-amd64 1 SMP Debian 5.10.28-1kali1 2021-04-12 x8664 GNU/Linux Dependencies root@kitploit: gcc Usage Steps root@kitploit: git...
CVE-2022-22947_exp
CVE-2022-22947-exp CVE-2022-22947 Exploit script Use root@kitploit: python3 CVE-2022-22947.py Example: python3 CVE-2022-22947.py http://127.0.0.1:8080 "cat /etc/passwd"...
SEcraper
SEcraper Search engine scraper tool with BASH script. Dependency curl cli Available search engine Ask.com Search.yahoo.com Bing.com Installation root@kitploit: git clone https://github.com/zerobyte-id/SEcraper.git cd SEcraper/ Run root@kitploit: bash secraper.bash "QUERY" Thank you : If you want ...
Sherlock
Deprecated. Have a look at Watson instead. Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. Currently looks for: MS10-015 : User Mode to Ring KiTrap0D MS10-092 : Task Scheduler MS13-053 : NTUserMessageCall Win32k Kernel Pool...
smtp_userenum
smtpuserenum Help: root@kitploit: python3 smtpuserenum.py -h Usage: root@kitploit: python3 smtpuserenum.py You can change the username list:...
chromebackdoor
VIDEO Install Text V 3.0 Install Video OLD Binder guide Module guide Form grabber plugins Facebook MessengerSpy plugins Jabber Notifier/ Hide Panel Windows infection Rubber Ducky Payload Require: pip install crxmake wine32 Let's go root@kitploit: python chromebackdoor.py user: root pass: toor KAL...