Detection-struts-cve-2017-5638-detector

🚨 Real-Time Anomaly Detection for Apache Struts CVE-2017-5638 Zero-Day Exploit Detection Based on Streaming Analytics & Probabilistic Data Structures 📌 Project Description This project is a real-time anomaly detection system designed to detect RCE Remote Code Execution exploits on Apache Struts...

OpenAM

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements, and Web Services Security. Cross Domain Single Sign On CDSSO, SAML 2.0, OAuth 2.0 & OpenID Connect ensure that OpenAM integrates easily with legacy, custom, a...

CVE-2026-32127_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-32127 - SQL Injection Vulnerability in OpenEMR 8.0.0 Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not...

CVE-2025-48734

CVE-2025-48734: Apache Commons BeanUtils – enum declaringClass Information Leak & RCE Chain For educational and authorized security research purposes only. This repository provides a controlled lab environment to reproduce the CVE-2025-48734 vulnerability in Apache Commons BeanUtils and explore h...

kernel-exploits

Kernel Exploits Various kernel exploits CVE-2021-22555 Linux local root exploit. Updated version of theflow's exploit for CVE-2021-22555. A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a D...

CVE-2025-43529

CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and iPadOS 26.2, along with a security advisory that includes fixes for WebKit vulnerabilities. One bug in the DFG JIT compiler CVE-2025-43529 stood out, so I decided to dig into it. The JIT compiler correctly recognized that a Phi node where...

analyzeMFT

AnalyzeMFT Status : All tests passing across Python 3.8-3.12 on Windows, macOS, and Linux. Quick Start root@kitploit: Install pip install analyzeMFT Basic usage python analyzeMFT.py -f MFTFILE -o output.csv --csv Generate test MFT for testing python -c "from src.analyzeMFT.testgenerator import...

CVE-2026-33917_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-33917 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...

CVE-2025-31864

CVE-2025-31864 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Beam me up Scotty – Back to Top Button Vulnerable version = 1.0.23 Component slug beam-me-up-scotty Component link https://wordpress.org/plugins/beam-me-up-scotty/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3:...

CVE-2026-41089-Netlogon-RCE

🛡️ CVE-2026-41089-Netlogon-RCE - Analyze critical Windows service security vulnerabilities This repository provides tools to analyze and test the Netlogon vulnerability known as CVE-2026-41089. This tool helps security professionals identify if their Windows Domain Controllers face risks from this...

CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are...

-Pluck-CMS-RCE-CVE-2023-50564

exploit.py 🐍💥 ⚠️ Legal / ethical notice: this script is only for authorized environments ✅ CTFs, labs, pentesting with permission. Do not use it against systems without authorization ❌. 🧾 What does this script do? exploitgreenhorn.py automates a typical exploitation chain on a web panel: ✅ Logs...

SpringSource__spring-security-oauth_CVE-2018-1260_2-3-2-RELEASE

This project provides support for using Spring Security with OAuth 1a and OAuth2. It provides features for implementing both consumers and providers of these protocols using standard Spring and Spring Security programming models and configuration idioms. Code of Conduct This project adheres to th...

CVE-2025-2304-POC

CVE-2025-2304-POC Manual poc for CVE-2025-2304: Camaleon CMS Version 2.9.0 Exploitation Steps 1. Log in as a low-privileged user e.g., "Bob". 2. Intercept the password change using a proxy e.g Burpsuite, caido and more 3. Capture the updatedajax request during a password change. 4. Inject the...

GuardReasoner-VL

GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoning Yue Liu, Shengfang Zhai, Mingzhe Du Yulin Chen, Tri Cao, Hongcheng Gao, Cheng Wang Xinfeng Li, Kun Wang, Junfeng Fang, Jiaheng Zhang, Bryan Hooi 1National University of Singapore, 2Nanyang Technological University To enhance the safety ...

badkeys

badkeys Tool and library to check cryptographic public keys for known vulnerabilities what? badkeys checks public keys in various formats for known vulnerabilities. A web version can be found at badkeys.info. install badkeys can be installed via pip: root@kitploit: pip3 install badkeys You may wa...

CVE-2026-15460 Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-15460

CVE-2026-15460 affects Zephyr RTOS Bluetooth Classic (BR/EDR) L2CAP, specifically the receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/classic/l2cap_br.c. The handler dispatched inbound data PDUs based solely on the destination channel ID without verifying the channel had reached BT_L2...

EUVD-2026-75212

The Bluetooth Classic BR/EDR L2CAP receive handler btl2capbrrecv in subsys/bluetooth/host/classic/l2capbr.c dispatched inbound data PDUs based only on the destination channel ID, without checking that the target channel had reached the BTL2CAPCONNECTED state. A dynamic channel is assigned its RX...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized organization registration via improper invitation token validation Disclaimer This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer syste...