mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

CVE-2024-23722-poc

CVE-2024-23722-poc Usage root@kitploit: python3 exploit.py http://127.0.0.1:8888 port is currently not open port is currently not open port is currently not open port is currently not open Server might have crashed port is currently not open port is currently not open port is currently not open...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: A re-implementation of https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py Uses uuids as part of the requested filename to avoid remote server crashing after first path traversal exploitation. run.py / shell.py: wrapper on top of podman to run...

CVE-2022-46485

CVE-2022-46485 ngDoS - ngSurvey Notes: The "slider" question may also be vulnerable with a large integer instead of a string. It could not be confirmed in my local environment. Exploitation steps Open the survey page and find a text or comment field. Fill the survey normally. In the text or comme...

CVE-2026-61666

A flaw was found in websocket-driver. A remote attacker can exploit this vulnerability by sending a malformed Host header that does not conform to a valid host:port string. This action triggers an uncaught exception, leading to a Denial of Service DoS by crashing the WebSocket server and making i...

CVE-2026-66729-Out-of-Bounds-Read-in-facil.io-MIME-Parser-leads-to-Server-Crash

Security Disclosure: Out-of-Bounds Read in facil.io MIME Parser leads to Server crash Assigned CVE ID CVE-2026-66729 Product: facil.io Affected versions: facil.io = 0.6.0 all 0.6.x, all 0.7.x, master; introduced when the MIME parser was added in 0.6.0 Component:...

CVE-2026-23918

CVE-2026-23918 Apache modhttp2 Double-Free Detector https://github.com/user-attachments/assets/d6c30e58-548c-4b6d-9ba3-baa667238a58 root@kitploit: python3 h2ghost.py -h usage: h2ghost.py -h --host HOST --port PORT --tls --no-tls --iterations ITERATIONS --burst-n BURSTN --timeout TIMEOUT...

CVE-2026-31402

🛡️ CVE-2026-31402 – NFSv4 LOCK Replay Cache Heap Overflow CVE-2026-31402: Linux NFS Bug Hidden for 23 Years 📌 Overview CVE-2026-31402 is a heap overflow vulnerability in the NFSv4.0 LOCK replay cache of the Linux kernel. It arises due to improper handling of responses larger than the fixed buffer...

CVE-2026-92081

A flaw was found in fastify. When a route registers a response trailer and is served over HTTP/2, fastify incorrectly sets the 'Transfer-Encoding: chunked' header. This leads to an unhandled exception in Node.js, causing the server process to crash and resulting in a Denial of Service DoS. A...

CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses

fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply.trailer and is served over HTTP/2, fastify unconditionally sets the Transfer-Encoding: chunked header, which is forbidden on HTTP/2, so Node.js throws while...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

Security Advisory: Unchecked Room Lookup Leads to Server Crash Let's Chat Assigned CVE ID: CVE-2026-66749 Summary One HTTP request from any logged-in account shuts down the Let's Chat server process. GET /messages takes a room parameter, looks that room up by id, and then calls a method on the...

CVE-2025-21574-Exploit

CVE-2025-21574-Exploit Key Features of this Black-Box Exploit: 1. Credential Brute-Forcing: Tests 12+ common default username/password combinations Checks 5 common system databases Automatically detects valid credentials 2. Anonymous Access Attempt: Tries connecting without any credentials Tests...

cve-2015-5477

PoC for BOND9 TKEY assert DoS CVE-2015-5477 This exploit tests to see if a BIND9 server is vulnerable by sending the exploit in order to see if it crashes. It's C code that you compile the normal way on Unix/Window, such as: root@kitploit: gcc tkill.c -o tkill It'll run over both IPv4 and IPv6...

Astra Linux – Vulnerability in isc-dhcp

In ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16, ISC DHCP 4.4.0 - 4.4.2 Other branches of ISC DHCP e.g., releases in the 4.0.x series or earlier, and releases in the 4.3.x series are beyond their End-of-Life period and are no longer supported by ISC. It is clear that this defect is also present in releases...

Astra Linux – Vulnerability in Apache2

Servicing WebSocket protocol upgrades over an HTTP/2 connection may lead to a Null Pointer dereference, causing the server process to crash and degrading performance...

Astra Linux – Vulnerability in rabbitMQ-server

Pivotal RabbitMQ versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, as well as RabbitMQ for Pivotal Platform versions 1.16.x prior to 1.16.7 and 1.17.x prior to 1.17.4, contain a web management plugin that is vulnerable to a denial-of-service attack. The “X-Reason” HTTP header can be...

EUVD-2026-77370

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit size of unpacked SDP messages compressed with zlib, which allows attacker to deny service or crash server via sending many SDP messages that unpack to large size.. Mattermost Advisory ID:...

DEBIAN-CVE-2026-89684

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

AZL-100653 CVE-2026-89684 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4initcpstate nfs4allocinitcpntfstate published the new cpntf entry into the s2scpstateids IDR with cstype set in one s2scplock section, then took the lock again to listadd it onto pstid-sccplist...

AZL-101778 CVE-2026-87776 affecting package python-tensorboard 2.16.2-6

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...