cryptr

cryptr A simple shell utility for encrypting and decrypting files using OpenSSL. Installation root@kitploit: git clone https://github.com/nodesocket/cryptr.git ln -s "$PWD"/cryptr/cryptr.bash /usr/local/bin/cryptr Requirements shred if optionally deleting original file. Bash tab completion Add...

CVE-2017-16568

CVE-2017-16568 1. Exploit Title: Logitech Media Server : HTML code injection and execution. 2. Shodan Dork: Search Logitech Media Server 3. Date: 11/03/2017 4. Exploit Author: Dewank Pant 5. Vendor Homepage: www.logitech.com 6. Version: 7.9.0 7. Tested on: Windows 10, Linux POC: 1. Access and go ...

BurpSuiteSharpenerEx

Burp Suite Sharpener Esta extensión mejora Burp Suite añadiendo varias características de interfaz de usuario y funcionales, lo que la hace más fácil de usar. Consulte la sección "Compatibilidad de Burp Suite y notificación de errores" para obtener información detallada sobre la compatibilidad...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

generator-burp-extension

Burp Extension Generator Installation First, install Yeoman and generator-burp-extension using npm we assume you have pre-installed node.js. root@kitploit: npm install -g yo npm install -g generator-burp-extension Then generate your new project: root@kitploit: yo burp-extension Burp Extension...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

CVE-2017-16567

CVE-2017-16567 1. Título del exploit: Logitech Media Server: Cross Site Scripting persistente XSS 2. Shodan Dork: Buscar Logitech Media Server 3. Fecha: 11/03/2017 4. Autor del exploit: Dewank Pant 5. Página web del proveedor: www.logitech.com 6. Versión: 7.9.0 7. Probado en: Windows 10, Linux PO...

CVE-2026-39107

CVE-2026-39107: Cross-Site Scripting XSS en Kimi AI v1.0 Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS en la función 'Preview' de la interfaz web de Kimi AI v1.0. La aplicación no sanea ni codifica adecuadamente las cargas útiles HTML/JavaScript generadas por el modelo de IA...

CVE-2026-9290

CVE-2026-9290 — Exploit de LFI a RCE en WP User Manager Path Traversal sin autenticación a través del parámetro 'tab' → Inclusión Local de Archivos LFI Resumen CVE-2026-9290 es una vulnerabilidad de Inclusión Local de Archivos LFI sin autenticación, de severidad alta CVSS 7.5, en el plugin de...

Malicious code in @vite-tab/tabui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5178b465689483c264c60f883fe971a7fa7c9332b22a10281b652f6262c7731d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16371 Malicious code in @vite-tab/tabui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5178b465689483c264c60f883fe971a7fa7c9332b22a10281b652f6262c7731d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

smt878u-ionstack-poc

smt878u-ionstack-poc Pure-C, host-assisted re-root proof of concept for Samsung Galaxy Tab S7 SM-T878U / gts7l against CVE-2026-43499 IonStack / GhostLock. The runtime chain uses native C/ELF components only. It does not require Python, Java, DEX, appprocess, or a JVM on the Android target. ADB i...

CVE-2026-40791-WP-Time-Slots-Booking-Form-XSS

CVE-2026-40791: One Booking Slot to Admin XSS I found an unauthenticated stored XSS in the WordPress WP Time Slots Booking Form plugin. A public booking submission controls part of the stored time-slot value. The plugin later prints that value into the administrator Booking Orders page without...

CVE-2017-7089

CVE-2017-7089 Impact : Processing maliciously crafted web content may lead to universal cross site scripting Description : A logic issue existed in the handling of the parent-tab. This issue was addressed with improved state management. Safari 10 Local SOP bypass root@kitploit: function Pewvar...

CVE-2024-40507

CVE-2024-40507 Vulnerabilidad de Cross Site Scripting en openPetra v.2023.02 a través de la función serverMPersonnel.asmx. Descripción : Un usuario no autenticado puede robar las cookies de un usuario autenticado explotando un XSS en openPetra v.2023.02 a través de la función serverMPersonnel.asm...

CVE-2022-4556

CVE-2022-4556 - Stored XSS in SOGo Webmail v5.7.1 🧠 Summary A Stored Cross-Site Scripting XSS vulnerability was discovered in the fullName field of the Identity Preferences section in the SOGo web interface , affecting version 5.7.1. An authenticated attacker could inject a malicious script that...

BIT-ZOOKEEPER-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

TeamsNTLMLeak

Descripción Cuando un usuario navega a una pestaña "Website" que dirige a una página web especialmente diseñada, puede resultar en la exposición del hash NTLM mediante la activación de un esquema de URL de Office, reduciendo así el proceso a una ruta de un solo clic para la fuga. Si se intenta...

Leaked-Credentials

Para buscar credenciales filtradas usando las Herramientas para Desarrolladores de Google Chrome y expresiones regulares, sigue estos breves pasos: 1. Abrir DevTools: En Chrome, navega al sitio que estás inspeccionando y luego abre las Herramientas para Desarrolladores con Ctrl+Shift+I...

MiracleLinux 9 : coreutils-8.32-41.el9_8.1 (AXSA:2026-1880:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1880:05 advisory. coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values CVE-2026-56392 Tenable has extracted the preceding description block directl...