Injectus

Injectus Simple python tool that goes through a list of URLs trying CRLF and open redirect payloads. root@kitploit: ▪ ▐ ▄ ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ · ██ •█▌▐█ ·██▀▄.▀·▐█ ▌▪•██ █▪██▌▐█ ▀. ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄ ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█ ▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀ ▀▀▀ ▀...

CVE-2019-11708

Full chain exploit for CVE-2019-11708 & CVE-2019-9810 This is a full browser compromise exploit chain CVE-2019-11708 & CVE-2019-9810 targeting Firefox on Windows 64-bit. It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 t...

Serein

Serein | En el atardecer de lluvia | Este proyecto está en pausa Linux English version is online! | ¡Ya está disponible la versión en inglés de Linux! http://github.com/W01fh4cker/SereinLinux Declaration | Declaración Este proyecto está destinado solo para uso autorizado. Prohibido su uso para...

CVE-2021-22986_Check

CVE-2021-22986Check CVE-2021-22986 Checker Script in Python3 How to Use: python3 checker.py -u http://url Output: root@kitploit: HOST IS NOT VULNERABLE: | | | / | | | | | | | | | | | | | | | | \ \ | ' | |/ | | | | | | | | | | | | | || |/ |/| ./||/||| | | || Vuln Checker ! Target: http://URL +...

ingress-nginx

Ingress NGINX Retirement Retiring What You Need to Know about Ingress NGINX Retirement: Best-effort maintenance will continue until March 2026. Afterward, there will be no further releases, no bugfixes, and no updates to resolve any security vulnerabilities that may be discovered. Existing...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com Redirección a un sitio web arbitrario en este caso, https://example.com. parcheado: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

CVE-2025-69600

CVE-2025-69600 author: Rafael José Núñez Gulías company: Iberian Var Group Affected products: RayVentory Scan Engine 12.6 Update 8 and previous versions Raynet advisory: RSEC200966 Command injection in Raynet's rvia allows adversaries to execute commands via getconfig, upload, inventory, and orac...

CVE-2025-24893-POC

CVE-2025-24893-POC A POC for CVE-2025-24893 written in python Usage python3 -u the url...

OutlookLeakTest

The Outlook HTML Leak Test Project! Blog post: https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/may/smb-hash-hijacking-and-user-tracking-in-ms-outlook/ What's in "./Schemes-List.xlsx"? List of URI schemes that might work in Windows. These schemes/protocols can be useful in...

behat-config-leaks

Badges License MIT Installation...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Unauthenticated SQL Injection via URL Path Description The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficien...

shell-history-leaks

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install shell-history-leaks Run bellow command to check shell-history-leaks -h Configurations 2. We integrated with the...

openredirect

Badges License MIT Installation...

laravel-ignition-Rxss

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install laravel-ignition-rxss Run bellow command to check laravel-ignition-rxss -h Configurations 2. We integrated with...

BurpSuite-Grand-Master-Tools

BurpSuite-Grand-Master-Tools Bynu11secur1ty — A modular toolkit that transforms Burp captures into instant, repeatable actions. Convert. Reuse. Open. Automate. 🚀 Elevator pitch BurpSuite-Grand-Master-Tools is a lightweight, auditable, and extensible toolkit for pentesters and bug bounty hunters...

jsluice

jsluice jsluice is a Go package and command-line tool for extracting URLs, paths, secrets, and other interesting data from JavaScript source code. If you want to do those things right away: look at the command-line tool. If you want to integrate jsluice's capabilities with your own project: look ...

CVE-2025-47273-PoC

CVE-2025-47273: setuptools version 78.1.0 - Path Traversal in setuptools.packageindex Disclaimer This Proof of Concept PoC is intended for educational purposes and authorized security auditing only. The author assumes no responsibility for misuse of this information. Unauthorized access to comput...

CVE-2026-73315

CVE-2026-73315: SSRF through PayPal certificate URL XenForo before 2.3.13 fetches the certificate URL supplied by a PayPal REST webhook without restricting its destination. What happens The callback handler passes PAYPAL-CERT-URL to XenForo's trusted HTTP reader. It does not require a PayPal...

CVE-2023-21887

CVE-2023-21887 Exploit This script scans a list of URLs for the CVE-2023-46805 vulnerability and exploits it Usage 1. Install required dependencies: root@kitploit: pip install httpx...

CVE-2026-57440

The EmbedVideo Extension for MediaWiki is vulnerable to HTML/JavaScript injection in versions prior to 4.1.0 . When the $wgEmbedVideoRequireConsent setting is disabled, the extension fails to sanitize video URLs passed into an iframe src attribute. An attacker can provide a malformed URL or ID us...