Lucene search
+L

957 matches found

Kitploit
Kitploit
added 2026/09/04 9:26 a.m.5 views

metasploitable2-exploitation-metasploit

Exploiting Metasploitable2 with Metasploit: VSFTPD, Samba, and More A hands-on walkthrough of exploitation using the Metasploit Framework — from PostgreSQL database setup and dbnmap scanning, through three root shells via vsftpd, Samba, and UnrealIRCd, to credential exfiltration with Netcat...

10CVSS8.6AI score0.96184EPSS
SaveExploits61References1
Kitploit
Kitploit
added 2026/09/04 7:53 a.m.5 views

FakeAuth

FakeAuth FakeAuthは、ユーザーの認証情報を入力要求し、HTTPプロトコルで外部に送信するツールです。 以下のプロジェクトに触発されました 1. hlldz氏のPICKL3 https://github.com/hlldz/pickl3 汚いコードとバグがあるかもしれません ; インストール 特別な要件はありません 使い方 v1.01 root@kitploit: Usage: FakeAuth.exe Example: FakeAuth.exe 1 1 1 10 windowtitle entercreds 10.0.0.0:80\n hide integer - Hid...

5.9AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/04 6:40 a.m.3 views

agent-vault

HTTP credential proxy and vault An open-source credential broker by Infisical that sits between your agents and the APIs they call. Agents should not possess credentials. Agent Vault eliminates credential exfiltration risk with brokered access. New here? Thelaunch blog post has the full story...

6AI score
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/04 5:59 a.m.5 views

TeamFiltration

TeamFiltration TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 EntraID accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running! This tool has bee...

5.8AI score
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/04 5:32 a.m.5 views

tirith

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog | Releases Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL...

6.1AI score
SaveExploits0References38
Kitploit
Kitploit
added 2026/09/03 11:55 p.m.6 views

WifiPassword-Stealer

WifiPassword-Stealer Get All Registered Wifi Passwords from Target Computer. INSTALLATION if you are using a python file root@kitploit: pip install smtplib pip install subprocess pip install glob USAGE •Create an account on "https://mailtrap.io/" using a temp mail. •Set your own SMTP USERNAME and...

5.9AI score
SaveExploits0References4
NVD
NVD
added 2026/09/03 1:06 p.m.4 views

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

7.2CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/03 11:22 a.m.10 views

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 fails to validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node ). A shared-workflow editor or any user creating/updating a workflow via the REST API, Public API, or MCP can p...

7.2CVSS5.9AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/03 11:22 a.m.26 views

CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

7.2CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/03 11:22 a.m.4 views

EUVD-2026-70401

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

7.2CVSS5.9AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 5:18 p.m.31 views

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

6.5CVSS0.00313EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/02 5:18 p.m.3 views

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

6.5CVSS5.8AI score
SaveExploits0References11
CVE
CVE
added 2026/09/02 5:18 p.m.26 views

CVE-2026-84377

LiteLLM (an AI Gateway/proxy server for LLM APIs) is affected by an authenticated SSRF and provider-credential exfiltration vulnerability prior to versions 1.88.6 and 1.96.2 . The root cause lies in incomplete request validation across multiple proxy files (auth_utils.py, common_request_processin...

6.5CVSS5.8AI score0.00313EPSS
SaveExploits0References9
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/09/01 5:16 p.m.8 views

Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

5.9AI score
SaveExploits0References2
OSV
OSV
added 2026/09/01 5:16 p.m.5 views

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/01 4:44 a.m.2 views

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- On February 13, 2024, Microsoft published a critical security vulnerability in Microsoft Outlook, identified as CVE-2024-21413, known as the Moniker Link Vulnerability. The vulnerability allows an attacker to bypass Outlook's Protected View...

9.8CVSS8.3AI score0.9466EPSS
SaveExploits24
Kitploit
Kitploit
added 2026/08/30 5:05 p.m.6 views

CVE-2023-7231

CVE-2023-7231 – Critical SSRF → Memcached/Docker RCE Chain via Audible fetchResource 🔥 Summary This vulnerability enables Server-Side Request Forgery SSRF in Audible’s fetchResource API on .audible.com, allowing unauthenticated attackers to pivot into internal infrastructure. Through SSRF payload...

7.3CVSS8.7AI score0.00438EPSS
SaveExploits3
NVD
NVD
added 2026/08/24 4:17 p.m.8 views

CVE-2026-71366

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

7.7CVSS0.00333EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/24 3:42 p.m.9 views

EUVD-2026-64923

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

7.7CVSS5.5AI score0.00333EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/24 3:42 p.m.22 views

CVE-2026-71366

A server-side request forgery (SSRF) vulnerability affects multiple AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) in Red Hat Ansible Automation Platform 2.5 and 2.6 . Notification template URLs are used as direct HTTP request targets without validating against private,...

7.7CVSS5.4AI score0.00333EPSS
SaveExploits0References6
Rows per page
Query Builder