CVE-2026-76904

GeoServer WFS Inventory and Authorized Verification This repository contains two Python scripts for investigating GeoServer WFS endpoints. Overview wfsinventory.py Purpose: Inventory layers, XSD fields, and WFS values, and optionally verify candidates via a time-based check. Execution examples:...

CVE-2024-30167

PoC For Atlona OME Authenticated Command Injection Disclaimer : This proof of concept is provided solely for educational and research purposes only. Do not use this code on systems you do not own or have explicit permission to test. I am not responsible for any misuse. An authenticated command...

CVE-2019-20933

LAB 5-CVE-2019-20933 I. SYSTEM ANALYSIS Identifying the Attack Surface Starting with what is running in the environment. I list all active containers: root@kitploit: docker ps The victim exposes a single port:8086. Currently, I do not have detailed information about the target. From the docker ps...

Exploit-CVE-2023-6063-PoC-Vuln

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC -red Proof of Concept PoC for CVE-2023-6063 , an unauthenticated, time-based blind SQL injection vulnerability affecting WP Fastest Cache ≤ 1.2.2. The vulnerability can be triggered through the wordpressloggedin cookie and may allow an attacker t...

CVE-2026-1581-Analysis-Lab

CVE-2026-1581 — wpForo Forum = 2.4.14 Unauthenticated Time‑Based SQL Injection ORDER BY ภาษาไทย Executive Summary...

CVE-2025-52021

CVE-2025-52021 — Time-Based Blind SQL Injection in PuneethReddyHC / Online Shopping System Advanced v1.0 CVE: CVE-2025-52021 Title: Time-Based Blind SQL Injection via productid parameter in editproduct.php Vendor / Repo: PuneethReddyHC —...

CVE-2026-5000

CVE-2026-5000 Important infromation This CVE has been approved by the CVE.org as well as the NVD. Please refer the following links of the reference. CVE.org - https://vulners.com/cve/CVE-2026-5000 NVD - https://nvd.nist.gov/vuln/detail/CVE-2026-5000 CVE-2026-5000 Windows Defender Vulnerability Po...

Zabbix-CVE-2024-42327-SQL-Injection-RCE

Zabbix-CVE-2024-42327 RCE PoC root@kitploit: / / | / / / | \ / \ / // / / // /| | / / / / / | | / / // // / / // / // // // // / / / / / / / / | |/ / /// // // / / // / // / / / / / |// //// // // //// // NSFOCUS CERT detected that Zabbix released a security announcement and fixed the SQL...

EUVD-2026-81296

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

Linux Distros Unpatched Vulnerability : CVE-2026-92987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XM...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109800)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109800 advisory. Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many...

Network-Detection-Engine

version: 0.001 Network Detection Engine root@kitploit: A lightweight 'Network Intrusion Detecion Engine' captures Live Traffic and detects real-world live attacks in real time. Zig0.15.2 . Featuress root@kitploit: - Live packet capture using libpcap - Custom packet parsing: - Ethernet - IPv4 - TC...

CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

CVE-2026-92596

Nodemailer , a Node.js email-sending library, is affected by a quadratic time complexity vulnerability in its addressparser component (versions before 9.1.0 ). A remote attacker can send a single email containing a crafted comma-separated address list with a large number of addresses, causing the...

SindriKit v2.0.0

SindriKit Offensive Development Deserves Better Architecture. A C library for building offensive capabilities. Core Concept Most offensive utilities hardcode their execution mechanics inside the technique's logic. A reflective loader doesn't just map an image; it maps it using a specific, hardcod...

marshalsec

Java Unmarshaller Security - Turning your data into code execution If you came here for Log4Shell/CVE-2021-44228, you may want to read about the exploitation vectors and affected Java runtime versions: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ Paper It's been more than two...

CVE-2026-92794 OpenSign through 2.41.3 Information Disclosure via getDocument

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identit...

EUVD-2026-81021

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-92749

SafeLine through version 9.4.1 contains an authentication bypass in its management console. The session-signing secret is derived from a time-seeded math/rand generator , allowing unauthenticated remote attackers who can bound the install timestamp to reconstruct the key offline and forge valid a...