299359 matches found
CVE-2026-24061-GNU-InetUtils-telnetd
CVE-2026โ24061 : GNU InetUtils telnetd Authentication Bypass Vulnerability CVE-2026โ24061 is a critical weakness in the telnetd service of GNU InetUtils CVE ID : CVE-2026โ24061 Severity : Critical CVSS 9.8 Attack Vector : Network Authentication Required : None Impact : Full system compromise root...
litellm-command-injection-security-assessment
CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for LiteLLM command injection risk, including executive summary, technical impact, remediation, and mitigation strategy. ๐ Report Snapshot Field| Detail...
CVE-2017-10271
LAB 2 - CVE-2017-10271: WebLogic XMLDecoder Deserialization Writeup I. System Analysis System Log Analysis Detected Service: Oracle WebLogic Server AdminServer belonging to basedomain running in Development Mode. Connection Port: 7001. Supported Protocols: http, t3, iiop, ldap, snmp. Attack Surfa...
CVE-2026-48800-PoC
CVE-2026-48800 โ Notepad++ Arbitrary Code Execution PoC Severity: High | Affected: Notepad++ โค 8.9.6 | Patched: v8.9.6.1 A PoC script for CVE-2026-48800, an arbitrary code execution vulnerability in Notepad++ โค 8.9.6 via shortcuts.xml. For full technical details, see the official security advisor...
CVE-2025-55182
CVE-2025-55182 React2Shell Exploit PoC โ ๏ธ WARNING: This project intentionally uses vulnerable software for security research purposes only. Credits All credits for the PoC go to @maple3142 Setup & Running Docker root@kitploit: docker-compose up --build The app will be available at...
Grafxploit
Automated Exploit Tool for Grafana CVE-2021-43798 Overview This project is an automated exploit tool designed to scan for and extract sensitive information from compromised Grafana instances vulnerable to CVE-2021-43798. The tool identifies vulnerable plugins and extracts SSH keys from compromise...
Codify-TJNULL-OSCP-
Hack The Box โ Codify Writeup Full penetration testing walkthrough and writeup for Codify machine on Hack The Box. ๐ Machine Info Field| Value ---|--- Name| Codify OS| Linux Difficulty| Easy Key Concepts| vm2 RCE CVE-2023-30547, SQLite DB Enum, Bcrypt Cracking, Bash Wildcard Pattern Matching Abus...
CVE-2018-20250
exp for Extracting Code Execution From Winrar poc by Ridter how to use ? you just need to install python 3.7, and prepare a evil file you want to run, set the values you want, this exp script will generate the evil archive file automatically! 1. set the values you want root@kitploit: ... ... The...
CVE-2021-3560
CVE-2021-3560 Privilege escalation via race condition in polkit. Vulnerability Description CVE-2021-3560 is a race condition in polkit that allows an unauthenticated local user to gain root privileges. The vulnerability exists in the way polkit handles D-Bus errors when a connection is terminated...
CVE-2025-4396
CVE-2025-4396 โ Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...
EXPLOIT-CVE-2026-8832-
EXPLOIT-CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...
Dirty-Frag-CVE-2026-43284
DirtyFrag CVE-2026-43284 - ๅฎ้ชๅฎคๆฃๆต็ปไน ๆฅๅ ๅ็ฑป๏ผ ๅ ้จๅฎ้ชๅฎค - CyberLAB ๆฅๆ๏ผ 2026ๅนด5ๆ24ๆฅ ๅนณๅฐ๏ผ Elastic Stack v9.4.1 ็ถๆ๏ผ ๆฃๆตๅทฒ็กฎ่ฎค ็ฎๅฝ A - ๆง่กๆ่ฆ B - ๅฎๆดๅ็ฐๆฅๅ 1. ็ฎๆ ไธๅจ่ๆจกๅ 2. ๆผๆด่ๆฏ 3. ๅฎ้ชๅฎค็ฏๅข 4. ็ฌฌไธ้ถๆฎต - ๆง่กๅ่ฎพ็ฝฎ 5. ็ฌฌไบ้ถๆฎต - ๆผๆดๅฉ็จๆง่ก 6. ็ฌฌไธ้ถๆฎต - ๅฉ็จๅๆดปๅจ 7. ็ฌฌๅ้ถๆฎต - ๆฃๆตๅทฅ็จ 8. ๆฃๆตๅ่ 9. ไธป่ฆๅ็ฐๆป็ป 10. ๅ่ A - ๆง่กๆ่ฆ ๆต่ฏๅ ๅฎน ไธไธชๅๆง็ๅฉ็จ็ปไน ๏ผๆจกๆไธไธชไฝฟ็จ DirtyFrag...
mi-laboratorio-log4shell
๐ Automated Log4Shell CVE-2021-44228 Play & Plug Lab An automated, single-command security research laboratory designed to demonstrate and audit the Log4Shell CVE-2021-44228 Remote Code Execution RCE vulnerability. This project consolidates all necessary components vulnerable application, malicio...
CVE-2024-55503
CVE-2024-55503 Termius App MacOS dylib Command injection Description An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLDINSERTLIBRARIES component. using dylib root@kitploit: DYLDINSERTLIBRARIES=exploitcombined.dylib...
Active-Directory-BadSuccessor
Active-Directory-BadSuccessor Overview In this room, we explore the BadSuccessor privilege escalation technique, a vulnerability that abuses delegated Managed Service Accounts dMSAs in Active Directory. The attack allows a user with sufficient control over a dMSA object to impersonate another...
dscanner
dScanner ๐ Automated web reconnaissance tool for security audits Description dScanner consolidates multiple reconnaissance tools into a single command for the initial phase of web pentesting. Use only on authorized systems!!!! ๐ Installation Required dependencies: curl dnsutils nmap whois httpx...
CVE-2026-24061-setup
CVE-2026-24061 Setup This repository contains the Docker setup for CVE-2026-24061. Once you have installed Docker, just do the following: 1. Clone this repository. 2. Run the following command: root@kitploit: sudo docker build . --tag telnetd-auth-bypass 3. Once the docker image is built, we can...
network-security-lab
๐ฌ Network Security Lab A controlled virtual environment simulating real-world attack and defense scenarios ๐ Overview This lab simulates a real-world penetration test and defensive hardening exercise in a fully isolated virtual environment. It demonstrates the full offensive security lifecycle โ...
redis-cve-2026-23479-check
redis-cve-2026-23479-check A safe, read-only version checker for CVE-2026-23479 โ the use-after-free in Redis's blocking-client code that lets an authenticated user reach remote code execution on the host. It does not exploit the bug. It connects, optionally authenticates, runs a single read-only...
CVE-2026-32646
CVE-2026-32646: Missing Authentication on Administrative Device Management Endpoint Advisory Field| Value ---|--- CVE| CVE-2026-32646 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 7.5 High Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE| CWE-306 Missing Authentication for Critical Function...