CallStackMasker

CallStackMasker This repository demonstrates a PoC technique for dynamically spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its call stack with a fake one and then restore the original before resuming execution. Hence, in the same way we can...

CVE-2024-9465

CVE-2024-9465 Checkpoint SQL Injection via Time-Based Attack CVE-2024-9465 SHODAN SEARCH root@kitploit: https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA SEARCH root@kitploit: https://en.fofa.info/ body="Expedition Project" || title="Expedition...

Revenant

Revenant Revenant is a 3rd party agent for Havoc written in C, and based on Talon. This implant is meant to expand on the Talon implant by implementing covert methods of execution, robust capabilities, and more customization. Setup This project aims to be a self-contained Havoc C2 implant. The go...

CVE-2023-1454

CVE-2023-1454 Script de detección de la vulnerabilidad CVE-2023-1454 Este artículo es solo para fines de referencia. No utilice los materiales técnicos y las herramientas del artículo para llevar a cabo intrusiones en ningún sistema informático sin autorización. El usuario es el único responsable...

EUVD-2026-87360

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker...

CVE-2026-10758

The Esri LERC open-source image or raster format is vulnerable to a Heap based Out-of-Bounds Write caused by an Integer Overflow . This flaw affects LERC versions 4.1.0 and earlier . A remote, unauthenticated attacker can exploit this by providing specifically crafted imagery to an application us...

CVE-2026-10758 Esri Lerc has a security vulnerability

Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds Write via Integer Overflow in LERC versions 4.1.0 and earlier may allow a remote, unauthenticated attacker who can pass specifically crafted attacker...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS This proof of concept, demostraste an security flaw of dom-bases XSS manipulating and using JQuery DOM Methods. eg:.append, .text,.html Payload i used: alert"Text: " + $"test".text; To test the vulnerability do the following: 1. Open and web console, on your browser and...

CVE-2026-54597

CVE-2026-54597 - Inyección SQL ciega basada en tiempo en ITFlow Gravedad: Alta Aviso: GHSA-m63v-j7fw-hq2h Afectado: ITFlow agent/ajax.php — parámetro expires Corregido en: Commit 63d8691 Autor: iltosec Resumen Una vulnerabilidad de inyección SQL ciega basada en tiempo en el manejador de generació...

CVE-2026-55200

Reporte de Seguridad: CVE-2026-55200 📝 Descripción General El CVE-2026-55200 es una vulnerabilidad crítica de desbordamiento de memoria basada en el heap corrupción de memoria dinámica que afecta a la biblioteca libssh2 en versiones hasta la 1.11.1. Permite a un servidor SSH malicioso comprometer...

CVE-2021-42667

CVE-2021-42667 CVE-2021-42667 - SQL Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: An SQL Injection vulnerability exists in the Event management software version 2.3.0. An attacker can leverage the vulnerable "id" parameter in the...

CVE-2025-7606

CVE-2025-7606 code-projects AVL Rooms Project V1.0/city.php inyección SQL NOMBRE DEL PRODUCTOS AFECTADOS AVL Rooms Página de inicio del proveedor https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ remitente dazhi Archivo vulnerable /city.php VERSIONES V1.0 Enlace d...

ephemora-cell

Ephemora Cell Ephemora Cell is a lightweight security and execution primitive for running untrusted code inside AI agents, MCP tools, plugins, and applications. root@kitploit: Run untrusted code. Control its capabilities. Bound its resources. Record what happened. Built for AI agents, MCP tools,...

doser.go

doser.go DoS tool for HTTP requests inspired by hulk but has more functionalities written in Go: How to use? 1. Compile it root@kitploit: go build doser.go 2. Use it For example: 999 threads sends GET requests. P.S: Do not really attack my website pls root@kitploit: ./doser -t 999 -g...

ghidralligator

Ghidralligator Ghidralligator is a C++ multi-architecture pcode emulator based on the Ghidra libsla, designed for fuzzing with AFL++. It allows performing emulation-based fuzzing while keeping interesting performances when dealing with binaries running on exotic architectures. Its extensible natu...

CVE-2023-48084-Revised

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023-48084-Revised Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection. Not the original repository. This is a derivative/improved PoC. Credit for the...

gha-lab-ca4fa82ac5

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of mesa/mesa at commit...

CVE-2024-36058

CVE-2024-36058 — Koha Library Software CVE ID: CVE-2024-36058 Product: Koha Library Software Vulnerability Type: Time-Based Blind SQL Injection CWE-89 CVSS Score: 8.1 High Authenticated Affected Versions: Below 22.05.22 Credits: Karolis Narvilas Description Koha is an open-source integrated libra...

ethibench

De lo controlado a lo salvaje: evaluación de agentes de pentesting en el mundo real Los agentes de pentesting con IA son cada vez más creíbles como sistemas ofensivos de seguridad, pero los benchmarks actuales aún proporcionan una guía limitada sobre qué sistemas tendrán un mejor rendimiento en...

SECURITY-218

This mitigation is obsolete as of Jenkins 2.54 and Jenkins LTS 2.46.2. If you have installed a 2.54+/LTS 2.46.2+ version of Jenkins anew, the Remoting-based CLI is disabled out of the box. If you installed an older version of Jenkins and upgraded to 2.54+ or LTS 2.46.2+, you will be prompted by a...