LinkedInDumper

LinkedInDumper Python 3 script to dump company employees from LinkedIn API 💬 Description LinkedInDumper is a Python 3 script that dumps employee data from the LinkedIn social networking platform. The results contain firstname, lastname, position title, location and a user's profile link. Only 2 A...

CVE-2020-14368

CSWSH-THEIA-CVE-2020-14368 Report target: Eclipse CHE deployment available on che.openshift.io Vulnerability type: Cross-site websocket hijack Discovery date: 2020-04-08 Author: Robin Duda codingchili@github Summary The /services websocket endpoint in Eclipse CHE adn Theia is vulnerable to...

wafpass

WAFPASS root@kitploit: ██╗ ██╗ █████╗ ███████╗██████╗ █████╗ ███████╗███████╗ ██║ ██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔════╝██╔════╝ ██║ █╗ ██║███████║█████╗ ██████╔╝███████║███████╗███████╗ ██║███╗██║██╔══██║██╔══╝ ██╔═══╝ ██╔══██║╚════██║╚════██║ ╚███╔███╔╝██║ ██║██║ ██║ ██║ ██║███████║███████...

cve-2025-29927-lab

CVE-2025-29927 Lab Minimal reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass CVSS 9.1. Companion to: N-Day Analysis writeup on Medium What this is A Next.js 15.2.2 app vulnerable with a cookie-gated /dashboard route. The middleware auth check can be bypassed by sending...

SubGPT

SubGPT looks at subdomains you have already discovered for a domain and uses BingGPT to find more. Best part? It's free! The following subdomains were found by this tool with these 30 subdomains as input. root@kitploit: call-prompts-staging.example.com dclb02-dca1.prod.example.com...

CVE-2020-10199-10204

CVE-2020-10199-10204 http://1984-0day.com root@kitploit: python3 poc.py -i 127.0.0.1 -p 8081 -c cookie -csrf csrf-token parse = argparse.ArgumentParser parse.addargument'-i', '--ip', help='ip' parse.addargument'-p', '--port', default='8081', help='port' parse.addargument'-c', '--cookie', help='HT...

EUVD-2026-75111

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-74752

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP. When cookie authentication is disabled, the system improperly validates authentication AUTH fields restored directly from peer-controlled cookie bytes. A local attacker could exploit this by forging RANDOM lengths o...

SUSE CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

UBUNTU-CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-74752

CVE-2026-74752 is a critical (CVSS 9.8) vulnerability in the Linux kernel's SCTP implementation. When cookie authentication is disabled, the COOKIE_ECHO handler restores fixed-size AUTH fields directly from peer-controlled cookie bytes without validating them against local backing arrays. A forge...

CVE-2026-74752 sctp: validate cookie AUTH state before use

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

CVE-2026-72398

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. When cookie authentication is disabled, a remote attacker can tamper with the INIT chunk data during the SCTP handshake. This occurs because the reconstructed INIT chunk from the COOKIE-ECHO...

CVE-2026-72398 sctp: add INIT verification after cookie unpacking

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

Linux Distros Unpatched Vulnerability : CVE-2026-72398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried i...

PT-2026-72586

In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then returns this cookie via COOKIE-ECHO, wher...

CVE-2026-50183

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI plugin. The plugin renders the snippet.title field returned by the YouTube Data API into the homepage gallery markup with no HTML encoding. The title is set ...

CVE-2026-50183

CVE-2026-50183 refers to a stored XSS in WWBN/AVideo via the YouTubeAPI plugin (versions 29.0 and below). The vulnerability occurs because the plugin renders YouTube data API field snippet.title into the homepage gallery without HTML encoding, allowing an attacker who controls a YouTube video mat...