barrido

barrido Console utility to find web application paths. Still in alpha version. Examples Multiple URLs bruteforcing: root@kitploit: $ cat urls.txt https://target.a.com https://target.b.com https://target.c.com $ barrido urls.txt wordlists/quickhits.txt -se | tee curiouspaths.txt...

fuxi

Fuxi 2.1 - developing Fuxi is cross-platform compatible and works in any Python 3.x environment including Linux, Mac OSX and Windows. Getting Started Docker root@kitploit: docker pull jeffzh3ng/fuxi docker run -itd --name fuxidocker -p 5000:50020 jeffzh3ng/fuxi:latest Wait about 15 seconds for th...

attack_monitor

Monitor de Ataques Attack Monitor es una aplicación Python escrita para mejorar las capacidades de monitoreo de seguridad de estaciones de trabajo/servidores de Windows 7/2008 y todas las versiones posteriores y para automatizar el análisis dinámico de malware. Modos actuales mutuamente...

reternal-quickstart

RE:TERNAL Nota: Todavía en desarrollo, solo usar para pruebas y ¡no exponer interfaces! El compose actual aún no funciona, solo intente si sabe lo que está haciendo RE:TERNAL es un servicio centralizado de orquestación de purple team para gestionar frameworks C2 de terceros. Los agentes se instal...

GHSA-57V5-WQX3-CGJ4 SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

Scope note please read first This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit acfc02ee8 "Improve database field visibility across views", 11020 and is live on v3.7.4-alpha.1, so it will ship in v3.7.4 unless gated first. No released stable...

Flextype CMS 1.0.0-alpha.3 Arbitrary File Read

Flextype CMS version 1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled...

Flextype CMS 1.0.0-alpha.3 Expression Injection

Flextype CMS version 1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability in the Entries ExpressionsDirective. An authenticated remote attacker with sufficient privileges to create or modify entries can persist arbitrary expression syntax within an entry field...

CVE-2026-21862

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

CVE-2026-24762 RustFS Logs Sensitive Credentials in Plaintext

RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material access key, secret key, session token to application logs at INFO level. This results in credentials being recorded in plaintext in log output, which may be...

CVE-2026-21862 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

CVE-2026-21862

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

EUVD-2026-5219

RustFS is a distributed object storage system built in Rust. Prior to version alpha.78, IP-based access control can be bypassed: getconditionvalues trusts client-supplied X-Forwarded-For/X-Real-Ip without verifying a trusted proxy, so any reachable client can spoof aws:SourceIp and satisfy...

CVE-2025-57396

Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escala...

CVE-2025-57396

Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escala...

CVE-2025-57396

CVE-2025-57396 affects Tandoor Recipes 2.0.0-alpha-1. The vulnerability arises from the User Profile API Endpoint, which contains two boolean values indicating whether a user is staff or administrative. This misconfiguration allows any user to escalate privileges to the highest level. The issue i...

Apache Hive 代码注入漏洞

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. A code...

CVE-2024-28867

Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies un-sanitized string values into metric names or labels, an attacker could make use of this and send a ?lang query parameter containing newlines, or similar...

CVE-2023-36123

Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code and gain sensitive information...

MindSpore 缓冲区错误漏洞

MindSpore is a new open source deep learning training/inference framework open-sourced by MindSpore. It can be used in mobile, edge and cloud scenarios. A buffer error vulnerability exists in MindSpore version 2.0.0-alpha, 2.0.0-rc1. An attacker exploited the vulnerability to cause memory...

Virtuozzo Hybrid Server 9 Alpha

The purpose of Virtuozzo Hybrid Server 9 alpha is to demonstrate the work in progress. The alpha version offers a few new features and supports creating virtual machines and containers with a limited number of guest operating systems...