EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash\graphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.query\complexity/3 multiplies child...

templates

قوالب التقارير ملاحظات حول بنية الدليل: يقوم السكربت generate-directories.py بجلب أحدث إصدار حالي من بنية VRT من GitHub وإنشاء أي أدلة مفقودة. ولا يقوم بإزالة أو إعادة تسمية الأدلة بناءً على العناصر التي تمت إزالتها من VRT. يتبع السكربت أسماء الإدخالات القياسية ويحافظ على الشرطات السفلية / حالة...

apache__jspwiki_CVE-2019-10089_2-11-0-M4

Apache JSPWiki 2.11 - Documentation root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

ASIS-CTF-Quals-2026

ASIS CTF Quals 2026 — Writeups Solutions, exploits, and write...

nahsra__antisamy_CVE-2016-10006_1-5-3

antisamy A library for performing fast, configurable cleansing of HTML coming from untrusted sources. Another way of saying that could be: It's an API that helps you make sure that clients don't supply malicious cargo code in the HTML they supply for their profile, comments, etc., that get...

apache__jspwiki_CVE-2019-10077_2-11-0-M3

Apache JSPWiki 2.11 - Documentation root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

Cheatsheet-God

diff UPDATE: Added my huge link of bookmarks / references ❤️ root@kitploit: هل لديك مليون إشارة مرجعية محفوظة؟ هل تحتوي كل هذه الإشارات المرجعية على معلومات فريدة؟ مستودعات Github تم وضع نجمة عليها لاحقًا؟ حسنًا، هذه مجموعة من كل هذه الموارد في مستودع واحد يُعرف باسم Cheatsheet-God. لا مزيد من...

xstream:XmlFuzzer: Security exception in java.base/java.lang.AbstractStringBuilder.<init>

Project: https://github.com/x-stream/xstream.git Detailed Report: https://oss-fuzz.com/testcase?key=5595632715497472 Project: xstream Fuzzing Engine: libFuzzer Fuzz Target: XmlFuzzer Job Type: libfuzzerasanxstream Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

RustyInjector

⚠️ Disclaimer: For Research and Educational Purposes Only This project is a Proof of Concept PoC demonstrating Bluetooth keystroke injection, re-implemented in Rust. It is intended strictly for educational and security research purposes. Do not use this code to compromise systems without explicit...

CVE

cve: A collection of code pertaining to CVE-2016-0728 various authors Excerpts from Linux, showing the evolution and fix of the bug Exploit code from Perception Point with added comments that explain what each line does. A short script that uses the leak to increment usage count, useful for...

watermarks-remover v0.5.0

root@kitploit: | | | || | | |/ |/| || |/ |/ |/ | |/| | | | | | |/ ||| | | | | | \ | | | | | \ | \ | \ | | | || / | | \ watermarks-remover Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files — for privacy and hygiene on content you own. The skill is a...

mcafee-sitelist-pwd-decryption

McAfee SiteList.xml फ़ाइल के लिए Python3 पासवर्ड डिक्रिप्शन टूल। लेखक: [email protected] ब्लॉग: http://funoverip.net तिथि: फरवरी 10, 2016 संदर्भ: https://funoverip.net/2016/02/mcafee-sitelist-xml-password-decryption/...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, but with wasm Status: validated crash PoC with demonstrated control-flow hijack crashpc = freed-cell poison 0xcdcdcdcdcdcdcdcd under the debug shell — the engine jumps to a pointer read out of the freed ICScript. Remaining work: control the reclaimed bytes. See research/README.md. ...

watermarks-remover

root@kitploit: | | | || | | |/ |/| || |/ |/ |/ | |/| | | | | | |/ ||| | | | | | \ | | | | | \ | \ | \ | | | || / | | \ watermarks-remover Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files — for privacy and hygiene on content you own. The skill is a...

XSS2Shell-CVE-2026-64638

XSS2Shell Multi-Target Scanner Developer: YogaGymn PoC/scanning utility for authorized WordPress security testing. The project contains a single-target exploitation workflow and a concurrent multi-target scan-only mode. Important: Use this project only on WordPress installations that you own or...

LogFileParser

Features Decode and dump $LogFile records and transaction entries. Decode NTFS attribute changes. Optionally resolve all datarun list information available in $LogFile. Option: "Reconstruct data runs". Recover transactions from slack space within $LogFile. Choose to reconstruct missing or damaged...

Gepetto

Gepetto Gepetto is a Python plugin which uses various large language models to provide meaning to functions decompiled by IDA Pro ≥ 7.6. It can leverage them to explain what a function does, and to automatically rename its variables. Here is a simple example of what results it can provide in mere...

sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

VCG

==================================================================================== VCG VisualCodeGrepper Current version: 2.3.2 ==================================================================================== Contents: 1. Overview 2. Latest additions to VCG V2.3.2 3. Using VCG Input...

OESA-2026-3547 python-sqlparse security update

A non-validating SQL parser. Security Fixes: Summary sqlparse contains a Regular Expression Denial of Service ReDoS vulnerability in its dollar-quoted SQL literal lexer. The regex pattern at sqlparse/keywords.py:33 uses a backreference \1 to match closing dollar-quote delimiters, causing On² CPU...