CVE-2025-40271

CVE-2025-40271 — procreaddirde rb-tree UAF LPE Proof-of-concept for a local privilege escalation vulnerability in the Linux kernel proc filesystem. The bug is a use-after-free in procreaddirde caused by rberase without RBCLEARNODE, leaving stale red-black tree links that can be raced during...

through_the_wire

Through the Wire Through the Wire es un exploit de prueba de concepto para CVE-2022-26134, una vulnerabilidad de inyección OGNL que afecta a Atlassian Confluence Server y Data Center versiones = 7.13.6 LTS y = 7.18.0 "Latest". Originalmente fue un zero-day explotado en la naturaleza. Aviso del...

h2t

h2t - HTTP Hardening Tool Description h2t is a simple tool to help sysadmins to hardening their websites. Until now h2t checks the website headers and recommends how to make it better. Dependences Python 3 colorama requests Install root@kitploit: $ git clone https://github.com/gildasio/h2t $ cd h...

MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

53R3N17Y

53R3N17Y Python based script for Information Gathering. To get the details hackertarget.com is used. There is a limit of 100 API calls per day from a single IP address. Update root@kitploit: ----- | | |--o--| ╒ 53R3N17Y ════════════════════════════════════╕ ---------´ │Python based script for...

RCE-CVE-2026-10520-CVE-2026-10523

CVE-2026-10520 and CVE-2026-10523 An Ivanti Sentry Authentication Bypass and Remote Code Execution Detection Artifact Generator. See our blog post for technical details. Detection in Action root@kitploit: $ python3 CVE-2026-10523.py --url https://127.0.0.1 --cmd "uname -a" / | | |\ \ \ / / \ \ /...

ysoserial.net

A proof-of-concept tool for generating payloads that exploit unsafe .NET object deserialization. Description ysoserial.net is a collection of utilities and property-oriented programming "gadget chains" discovered in common .NET libraries that can, under the right conditions, exploit .NET...

globalprotect-ca-cert-ipc

c2us.exe - Launches a command as the running user in the desktop session of the logged on user. In thise case, launches cmd.exe as SYSTEM in the desktop session of the unprivileged user. c2us.c - Source code for c2us.exe. epinject.exe - Entry point injector, used to spawn a new process and inject...

Important: Red Hat Security Advisory: xmlrpc-c security update

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

CVE-2025-53690

CVE-2025-53690 Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Code Injection.This issue affects Experience Manager XM: through 9.0; Experience Platform XP: through 9.0. How does this detection method work? This Nuclei...

Raccoon

Raccoon Offensive Security Tool for Reconnaissance and Information Gathering Features DNS details DNS visual mapping using DNS dumpster WHOIS information TLS Data - supported ciphers, TLS versions, certificate details and SANs Port Scan Services and scripts scan URL fuzzing and dir/file detection...

gha-lab-6255f5fc33

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

CVE-2022-21907-Vulnerability-PoC

CVE-2022-21907 Description - POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability. - create by antx at 2022-01-17, just some small fixes by Michele "[email protected]" Detail - HTTP Protocol Stack Remote Code Execution Vulnerability. - Similar to...

CVE_Project

CVEProject Preparations for exploitation: 1.Install Tomcat 7 on the virtual machine sudo apt-get install tomcat7 2.If the first step is failed,set JDKDIRS="/usr/lib/jvm/java-8-oracle" and add the statements “export JAVAHOME=/usr/lib/jvm/java-8-oracle” and “export CATALINAHOME=/usr/share/tomcat7”...

log4j-samples

log4j-samples Samples of log4j library versions to help log4j scanners / detectors including our own log4j-detector improve their accuracy for detecting CVE-2021-45046 and CVE-2021-44228. The samples include shaded jars, uber jars, spring-boot executable jars, jars inside jars, exploded jars, etc...

ansible-mysql-cve-2016-6662

ansible-mysql-cve-2016-6662 Simple ansible playbook to patch mysql servers against CVE-2016-6662. UPDATE 20160915.2347.CEST: Kenny informed me of Patrick Forsberg's catch that the original patch did not safeguard against ../ abuse. I've now replaced the patch with one that is more stringent based...

CVE-2022-1329

WP Elementor 3.6.0/1/2 Remote Code Execution root@kitploit: Google Dork: none Date: April 16 2022 Exploit Author: AkuCyberSec https://github.com/AkuCyberSec Vendor Homepage: https://elementor.com/ Software Link: https://wordpress.org/plugins/elementor/advanced/ scroll down to select the version...

CVE-2022-29063

CVE-2022-29063: Java Deserialization via RMI Connection in Apache OfBiz The OfBiz Solr plugin is configured by default to automatically make a RMI request on localhost, port 1099. By hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a...

React2Shell-CVE-2025-55182

🎯 React2Shell CVE-2025-55182: From React Server Components to Full RCE Difficulty: Intermediate → Advanced Category: Web Exploitation | Deserialization | RCE 🧩 Task 1: Introduction — Why React2Shell Is a Big Deal CVE-2025-55182, nicknamed React2Shell , is one of those vulnerabilities that instant...