opa

Open Policy Agent Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA is proud to be a graduated project in the Cloud Native Computing Foundation CNCF landscape. For details read the CNCF...

CVE-2024-24488

CVE-2024-24488 An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password component. Tested Versions CP3V2.0 - V11.10.00.2311090948 CWE CWE-313: Cleartext Storage in a File or on Disk Vulnerability Overview Devices...

CVE-2026-47630

CVE-2026-47630 — NVIDIA Triton Inference Server: arbitrary dlopen via TRITONBATCHSTRATEGYPATH Absolute path traversal in the custom batching-strategy loader of triton-inference-server/core. A model configuration parameter is passed unvalidated to dlopenRTLDNOW | RTLDLOCAL, so anyone able to...

gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility

A flaw was found in the gzexe utility of GNU gzip. When the mktemp utility is not available, gzexe creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path...

IonStack-S22U

CVE-2026-43499 - Galaxy S22 Ultra https://github.com/user-attachments/assets/f3d0858d-f8f5-444f-8ae5-541c2bc744c3 | ---|--- | This repository contains a device-specific port of the CVE-2026-43499 exploit for the Samsung Galaxy S22 Ultra SM-S908W. Supported target root@kitploit: Device: Samsung...

ghostlock-s26

GhostLock CVE-2026-43499 for the Galaxy S26 CVE-2026-43499 ported to the Samsung Galaxy S26 series — Android 16 / GKI 6.12. One binary, three kernel lines, dynamic parameter matching at runtime: theoretically covers the whole S26 series without per-build compilation. Most GhostLock porting effort...

CVE-2024-49138-POC

CVE-2024-49138-POC Fix Error Decombine root@kitploit: C:\Program Files\Microsoft Visual Studio\2022\Professional\MSBuild\Microsoft\VC\v170\Microsoft.CppBuild.targets456,5: error MSB8020: The build tools for Visual Studio 2019 Platform Toolset = 'v142' cannot be found. To build using the v142 buil...

pe_to_shellcode

petoshellcode Converts PE so that it can be then injected just like a normal shellcode. At the same time, the output file remains to be a valid PE. Supports both 32 and 64 bit PEs Authors:@hasherezade & @hh86 Objective The goal of this project is to provide a possibility to generate PE files that...

c-CVE-2024-0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

CVE-2022-22965

CVE-2022-22965 Spring4Shell-PoC Version Spring Framework 5.2.20 and 5.3.18 Patched version: Spring Framework 5.3.18 and 5.2.20 Spring Boot 2.6.6 and 2.5.12 Details Spring Core is the core component of Spring Framework. This is the foundation to build other components in the Spring Framework...

K8tools

K8tools Declaration: The tools are for security research or authorized penetration only. Any illegal use is at your own risk. Download: https://github.com/k8gege/K8tools Documentation: http://k8gege.org/p/72f1fea6.html PS: Updated irregularly. The files are relatively large, please download on...

google-poc

To reporoduce the CVE-2025-13425 just follow the steps below: Step 1: Clone the fresh osv-scalibr source code: root@kitploit: $ git clone https://github.com/google/osv-scalibr Step 2: Remove the code mentioned in fix commit...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

msidump

msidump MSI Dump – 一款用于分析恶意 MSI 安装包的工具，支持提取文件、流、二进制数据，并集成 YARA 扫描器。 对于启用了宏的 Office 文档，我们可以快速使用 oletools mraptor 判断文档是否恶意。如果希望进一步分析，可以使用 oletools olevba 或 oledump。 对于恶意 MSI 文件的分解，目前为止我们只有一个可靠且值得信赖的工具：lessmsi。 然而，lessmsi 并不具备我所需的功能： 快速分类 二进制数据提取 YARA 扫描 因此，msidump 应运而生。 特性 该工具有助于快速分类以及详细检查恶意 MSI...

D-Scan

When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse D-SCAN is an analysis framework for detecting document poisoning attacks in RAG Retrieval-Augmented Generation systems. It collects LLM internal states during generation token probabilities and attention weights,...

CVE-2017-5638

CVE-2017-5638 | Struts s2-045 Description It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to display an error message to a user. Affected versions Struts 2.3.5 Struts 2.3.31 Struts 2.5 Stru...

CVE-2022-32548-RCE-POC

CVE-2022-32548-RCE-POC DrayTek unauthenticated remote code execution vulnerability CVE-2022-32548 in /cgi-bin/wlogin.cgi via username field Technical details The web management interface of the vulnerable DrayTek devices is affected by a buffer overflow on the login page at /cgi-bin/wlogin.cgi. A...

CVE-2014-6271

Hellshocker 0.1.1 Tool to exploit Shellshock vulnerability Tired of using weak shellshock exploits or just "/bin/bash & /dev/tcp/IP/port 0&1" your way into the server? Yes, you need to upload and execute something more complex to the server, and base64 encoding a huge file is impossible for your...

SMBGhost_AutomateExploitation

SMBGhost CVE-2020-0796 Automate Exploitation and Detection This python program is a wrapper from the RCE SMBGhost vulnerability. All the credits for the working exploit to chompie1337. All the credits for the scanner to ioncodes. I just automate these functions in one program. You need to have in...

NMapGUI

Codacy Badge NMapGUI is an advanced graphical user interface for NMap network analysis tool. It allows to extend and ease the typical usage of NMap by providing a visual and fast interface with the application THIS PROJECT IS CURRENTLY UNMAINTAINED - For the moment Java8 is required. Later...