CVE-2026-67598

CVE-2026-67598 Emlog Pro — Validação de Certificado TLS Desativada no Assistente de IA MITM adjacente à rede → roubo de chave de API do provedor de LLM e injeção de resposta de IA...

reposcanner

Reposcanner Reposcanner é um script python para pesquisar no histórico de commits de repositórios Git em busca de strings interessantes, como chaves de API, inspirado pelo truffleHog. Instalação O módulo python Git é necessário python3-git no Debian. Docker root@kitploit: docker build -t...

dora

dora Funktionen Extrem schnell, da wir ripgrep im Backend verwenden Exploit-/PoC-Schritte für viele API-Schlüssel, die das Verfassen eines guten Berichts für Bug-Bounty-Jagd ermöglichen Im Gegensatz zu vielen anderen API-Key-Findern zeigt dora auch den Pfad zur Datei und die Zeile mit Kontext für...

sub.sh

🎯🕸📘 Multiprozess Parallel Subdomain-Erkennungs-Skript ✨ 🔺Sub.sh aber ohne API-Schlüssel 🔻 https://github.com/cihanmehmet/sub.sh ‼️ jq , httprobe und parallel erforderlich 📌 📘 ✅ Verwendete Dienste root@kitploit: + https://crt.sh + http://web.archive.org + https://dns.bufferover.run +...

poastal

Poastal - the Email OSINT tool Poastal is an email OSINT tool that provides valuable information on any email address. With Poastal, you can easily input an email address and it will quickly answer several questions, providing you with crucial information. ✨ Features Determine the name of the...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

mosint

Features • Installation • Services • Usage • Docker • Config • Screen Mosint is an automated email osint tool written in Go that allows you investigate for target emails in a fast and efficient manner. It consolidates numerous services, enabling security researchers to swiftly access a wealth of...

-CVE-2025-59528-PoC

CVE-2025-59528-PoC APENAS PARA FINS EDUCACIONAIS Um script simples em Python para explorar o CVE-2025-59528, uma vulnerabilidade de RCE autenticado na aplicação Flowise, uma ferramenta de IA popular, que também faz parte de um desafio sazonal do HTB, no qual testei inclusive. Se não estiver...

vanda-CVE-2025-3102

वांडा CVE-2025-3102 💣 CVE-2025-3102 भेद्यता के लिए ग्राफिकल इंटरफ़ेस के साथ एक्सप्लॉइट, WordPress प्लगइन SureTriggers = 1.0.78 में। 🚀 कार्यक्षमताएँ कमजोर साइटों की पहचान 🕵️‍♂️ स्वचालित शोषण जिसमें व्यवस्थापक उपयोगकर्ता बनाना 👨‍💻 साइबरपंक शैली का ग्राफिकल इंटरफ़ेस 🌌 परिणाम आसान संदर्भ के लिए .txt...

CVE-2026-22038

CVE-2026-22038 — AutoGPT Stagehand 블록이 로그에 API 키를 평문으로 기록 CVE ID: CVE-2026-22038 제품: AutoGPT 플랫폼 Stagehand 통합 영향을 받는 버전: autogpt-platform-beta-v0.6.45까지의 모든 버전 패치된 버전: autogpt-platform-beta-v0.6.46 취약점 유형: CWE-532 — 로그 파일에 민감한 정보 삽입 심각도: 높음 보고자: Panuganti Siva Aditya @sivaadityacoder 보고 날짜: 2025년...

CVE-2026-42208-Lab

CVE-2026-42208 — إثبات المفهوم الزمني لحقن SQL قبل المصادقة في LiteLLM مختبر Docker محلي وإثبات مفهوم بأقل ضرر لـ CVE-2026-42208، وهي ثغرة حقن SQL قبل المصادقة في مسار التحقق من مفتاح API في LiteLLM Proxy. يوضح هذا المستودع الفرق بين نسخة LiteLLM المعرضة للثغرة ونسخة LiteLLM المصححة باستخدام إثبا...

WordPress AI Engine plugin < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability

Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin AI Engine versions 3.6.4...

CVE-2023-27587-PoC

CVE-2023-27587-PoC O PoC simples da CVE-2023-27587 O que é o ReadToMyShoe? ReadtoMyShoe RTMS é uma aplicação web rust, yew e axum que permite carregar artigos através de URL ou colando diretamente e ouvi-los mais tarde. Impacto Se ocorrer um erro ao adicionar um artigo, o site mostra ao usuário u...

virustotalx

virustotalx para endpoints virustotalx para IPs V2 Instalação root@kitploit: git clone https://github.com/orwagodfather/virustotalx.git root@kitploit: cd virustotalx crie 3 contas https://www.virustotal.com/gui/join-us e copie as 3 chaves da API === root@kitploit: nano orwa.sh & root@kitploit: na...

threat-intel-brief-cve-2026-42208-litellm

Threat Intelligence Brief - CVE-2026-42208: Injeção SQL no BerriAI LiteLLM CVE: CVE-2026-42208 GHSA: GHSA-r75f-5x8p-qvmc Pontuação CVSS: 9.3 Crítica Software Afetado: BerriAI LiteLLM versões = 1.81.16, 1.83.7 Versão Corrigida: 1.83.7-stable lançada em 19 de abril de 2026 Adicionado ao CISA KEV: 0...

chaos-client

Chaos क्लाइंट Chaos डेटासेट API के साथ संचार करने के लिए गो क्लाइंट। अंग्रेज़ी • 中文 स्थापना root@kitploit: go install -v github.com/projectdiscovery/chaos-client/cmd/chaos@latest उपयोग root@kitploit: chaos -h यह टूल के लिए सहायता प्रदर्शित करेगा। यहाँ वे सभी स्विच हैं जो यह समर्थन करता है।...

Arisu

Arisu — AI Key 自动化采矿系统 Arisu 是一款自动扫描公开代码仓库（GitHub、GitLab、Gitee、Docker Hub、PyPI、npm 等）和代码片段（Gist、Issues、CommonCrawl），提取 AI 服务 API 密钥（DeepSeek、OpenAI、Anthropic、Kimi 等）并验证其有效性及余额的工具。提供 TUI 仪表板和多种输出格式（JSON、CSV、Markdown）。 功能特性 🔍 多源扫描 ：GitHub 代码搜索、Sourcegraph、Gist、Issues、GitLab、Gitee、Docker...

Zoho ManageEngine - getUserAPIKey Authentication Bypass

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

SimpleHelp <= 5.5.7 - Privilege Escalation

SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access. id: CVE-2024-57726 info: name...