CVE-2026-33626-Lab

CVE-2026-33626 — Laboratorio SSRF Vision-Language di LMDeploy Panoramica Questo repository riproduce CVE-2026-33626 , una vulnerabilità di Server-Side Request Forgery SSRF nel percorso di caricamento delle immagini vision-language di LMDeploy. Il comportamento vulnerabile si verifica quando...

CVE-2019-19781_IOCs

CVE-2019-19781IOCs IOCs per CVE-2019-19781 citrixhoneypotnslookup.txt contiene i risultati whois per gli indirizzi IP elencati in ips.txt. questi erano gli indirizzi che apparivano più frequentemente nei log dell'honeypot discusso qui:...

CVE-2024-24919

Accetta una lista di IP e puoi specificare il numero di thread con -t python3 exploit.py -i ips.txt -t 15 -o output.txt Solo per scopi educativi...

Identificador-CVE-2018-11759

Altra lingua git - pt-BR Controlla se le tue istanze sono esposte al CVE 2018-11759 Il file main è uno script bash per l'exploit. Gli URL devono usare il protocollo e l'indirizzo completo, esempio: https://test.site.com.br Per più URL in un'unica consultazione, si può usare l'here-document,...

CVE-2022-22972-

CVE-2022-22972-IOC-Liste IP-ADRESSEN • 23.36.163.250 • 64.32.6.143 • 217.175.49.100 HASHES • 6f17c8af555321cca16fe1695cc420eb9079fd187b8fa71d840f3cfd1f796117 • 040db8eacbd482c12ba03ab1a7c738be • 97ac734b671c815c43ea3287732046d2177e5bdad63e12315acc4902b8baa04d •...

KNOXout

KNOXout Una PoC per il rooting del Galaxy S6 basata sulla vulnerabilità CVE-2016-6584 Utilizza iovyroot di dosomder/idler1984 per la vulnerabilità iniziale write-what-where del kernel...

Scythe

Scythe scythe: enumerador de contas root@kitploit: O Enumerador de Contas foi projetado para facilitar a enumeração de contas como parte de testes de segurança. O framework oferece a capacidade de criar facilmente novos módulos arquivos XML e acelerar o processo de teste. Esta ferramenta foi cria...

iovyroot

iovyroot Uno strumento root basato sulla vulnerabilità CVE-2015-1805 Supporta 32 e 64 bit ma richiede indirizzi assoluti del kernel vedi offsets.c La PoC è stata realizzata da idler1984 https://github.com/idl3r/testcode...

bluemonday

bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include...

mapsdumper

root@kitploit: ▒█▀▄▀█ ░█▀▀█ ▒█▀▀█ ▒█▀▀▀█ ▒█▀▀▄ ▒█░▒█ ▒█▀▄▀█ ▒█▀▀█ ▒█▀▀▀ ▒█▀▀█ ▒█▒█▒█ ▒█▄▄█ ▒█▄▄█ ░▀▀▀▄▄ ▒█░▒█ ▒█░▒█ ▒█▒█▒█ ▒█▄▄█ ▒█▀▀▀ ▒█▄▄▀ ▒█░░▒█ ▒█░▒█ ▒█░░░ ▒█▄▄▄█ ▒█▄▄▀ ░▀▄▄▀ ▒█░░▒█ ▒█░░░ ▒█▄▄▄ ▒█░▒█ by: @Tegal1337 MAPSDUMPER Demo • Installazione • Funzionalità • Crediti Uno strumento per...

RansomCoinPublic

RansomCoin Extraktion von Metadaten und fest codierten Indikatoren für Kompromittierung aus Ransomware auf skalierbare, effiziente Weise mit Cuckoo-Integrationen. Idealerweise wird es während der Cuckoo-Dynamikanalyse ausgeführt, kann aber auch für statische Analysen großer Ransomware-Sammlungen...

mwebfp

LNHG - Massive Web Fingerprinter mwebfp Introduction The "LowNoiseHG LNHG Massive Web Fingerprinter " "mwebfp " from now on was conceived in July 2013 after realizing the usefulness of webserver screenshots to pentesters, during an engagement with large external or internal IP address ranges, as ...

CVE-2026-79777

rclone versions before v1.75.0 include full Go stack traces in RC API error responses when panics occur. An authenticated attacker (high privileges required) can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses. The CVSS 3.1 base score is 2.7 (LO...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

fail2ban

root@kitploit: / | | | | / | | |/ /| ' / | ' \ || ,||/|./,|||| v1.1.0.dev1 20??/??/?? Fail2Ban: ban hosts that cause multiple authentication errors Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system...

mcp-atlassian < 0.17.0 - Server-Side Request Forgery

MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...

Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

Mail Mint WordPress plugin 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication. id: CVE-2026-2025 info: name: Mail Mint 1.19.5 -...

vLLM 0.8.3 - 0.14.0 - Information Disclosure

vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images. id: CVE-2026-22778 info: name: vLLM 0.8....

Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users id: CVE-2022-0424 info: name: Popup by Supsystic 1.10.9 - Subscriber Email...