maude-hcs

Maude-HCS Maude-HCS is one of the first generalized and modular toolchains for formally specifying and reasoning about Hidden Communication Systems HCS at real-world scales. It enables network designers to explore alternative HCS designs quickly and effectively and provides formal...

house

root@kitploit: / | \ / / | | / // \ \ Y | /\ \ / | / /|// \ / House / / Dynamic Mobile Analysis Tool Contact: [email protected] House : A runtime mobile application analysis toolkit with a Web GUI, powered by Frida, written in Python. It is designed for helping assess mobile...

ThisSeemsWrong

이 문제에 대한 수정은 CVE-2024-49746으로 발표되었습니다: 공지, 패치 "이건 잘못된 것 같다" 위 제목은 Parcel::continueWrite 메서드의 주석으로, 실제로는 Parcel 객체의 크기를 조정하는 역할을 담당합니다. 이는 사용자가 명시적으로 요청할 때예: setDataSize를 통해 또는 현재 데이터 용량이 너무 작아 write 메서드 중 하나를 호출할 때 수행됩니다.cpp statust Parcel::continueWritesizet desired // SNIP: Validate desired siz...

tvsz

CVE-2018-6389 PoC node js multisite with proxy This script is based on CVE-2018-6389, a rather insidious problem in Wordpress, which unfortunately will likely not be fixed by the team developing the platform, even though it has been known for quite some time. !!! IMPORTANT BEFORE YOU CONTINUE !!!...

CVE-2024-1112

CVE-2024-1112 This is a PoC, I wrote for "ResHacker.exe" Heap overflow vulnerability. Usage Execute CVE-2024-1112.py, copy all string at created payload.txt then use it to as parameter to open ResHacker.exe root@kitploit: ResHacker.exe $string NOTE: Don't forget the find correct address - You can...

CVE-2026-58480

CVE-2026-58480 — Blocksy Companion Pro Unauthenticated File Upload RCE Advanced Reviews → saveattachments → Custom Fonts strpos Bypass → shell.woff2.php Overview CVE-2026-58480 also tracked as CVE-2026-15158 is a critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in Blocksy...

CVE-2023-46818-python-exploit

CVE-2023-46818 exploit This is a python version of the original php script for the vulnerability affecting ispconfig 3.2.11 and previous versions. Original PHP source: https://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html This proof-of-concept is intended for...

tap-ducky

TapDucky - Android USB HID Keystroke Injector TapDucky - Android USB HID Keystroke Injector Open-source DuckyScript runner for rooted Android with USB Gadget ConfigFS support TapDucky lets you create, customize, schedule, and run DuckyScript on Android by emulating a USB keyboard, mouse, or...

CVE-2022-34919

CVE-2022-34919 Contensis Content Management System prior to version 15.2.1.79 has a flaw in their 'Classic' interface that allows an unauthenticated user to upload and approve arbitrary files. By uploading an aspx file, it is possible to execute commands in the context of the web server. This...

C2Bridge

C2Bridges allow developers to create new custom communication protocols and quickly utilize them within Covenant. C2Bridges C2Bridges are used to develop an outbound command and control protocol without editing any Covenant code. For developers that feel comfortable integrating new listeners, a n...

CVE-2024-5932

This post is a research article published by EQSTLab. ❗❗ IMPORTANT ❗❗ There are currently fake PoC github repositories running xmrig. Check out the link below for more information : URL1: https://x.com/win3zz/status/1828704644987511107 URL2: https://x.com/bornunique911/status/1828712791844524453...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

CVE-2025-56771

Description During analysis of the ecodotempo.com.br website, a Stored Cross-Site Scripting XSS vulnerability was discovered. This vulnerability allows an attacker to inject malicious scripts into fields that are subsequently rendered to other users without proper sanitization, specifically on th...

CVE-2025-59382-QNAP-Password-Reset-Account-Takeover

CVE-2025-59382: QNAP Password Reset to Account Takeover Unauthenticated attacker-controlled password reset URL in /cgi-bin/resetpassword.cgi. Tested against QuTScloud c5.2.4.3041 build 20250211 in a lab. QNAP later published this as CVE-2025-59382 in advisory QSA-26-10. Short version An...

rwsploit

Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...

PowerLurk

PowerLurk PowerLurk is a PowerShell toolset for building malicious WMI Event Subsriptions. The goal is to make WMI events easier to fire off during a penetration test or red team engagement. Please see my post Creeping on Users with WMI Events: Introducing PowerLurk for more detailed information:...

CVE-2024-44541

CVE-2024-44541: SQL Injection Vulnerability in Inventio Lite v4 Description Inventio Lite v4 is vulnerable to SQL Injection SQLi in the /action=processlogin endpoint. This vulnerability allows attackers to inject arbitrary SQL queries via the username parameter in POST requests, potentially leadi...

CVE-2021-3560

CVE-2021-3560 Privilege escalation via race condition in polkit. Vulnerability Description CVE-2021-3560 is a race condition in polkit that allows an unauthenticated local user to gain root privileges. The vulnerability exists in the way polkit handles D-Bus errors when a connection is terminated...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build root@kitploit: git clone https://github.com/dnr6419/CVE-2022-23046.git cd...