CVE-2026-89796

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: avoid infinite kdamondmergeregions internal loop Patch series "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races", v1.1. Sashiko found a few issues in DAMON that could cause infinite loop, NULL...

KingOfBugBountyTips

KingOfBugBountyTips El Arsenal Definitivo de Reconocimiento para Bug Bounty "En las sombras cazamos, en el código confiamos" Telegram | Twitter | YouTube | LinkedIn DoD VDP Scope Programa de Divulgación de Vulnerabilidades del DoD | KingRecon DOD Alcance Completo del DoD - 19 Dominios bash BBRF...

content

Welcome! The purpose of this project is to create security policy content for various platforms — Red Hat Enterprise Linux , Fedora , Ubuntu , Debian , SUSE Linux Enterprise Server SLES ,... — as well as products — Firefox ,... We aim to make it as easy as possible to write new and maintain...

PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Upload in versions up to and including 0.9.123. This is due to improper error handling in the RSA decryption process...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destructive proof-of-concept and verification harness for CVE-2026-60137 , a blind SQL injection in WordPress core WPQuery::authornotin, reachable via the REST API's authorexclude parameter. Root Cause WPQuery::getposts builds SQL by...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

CVE-2019-17427

CVE-2019-17427 CVE-2019-17427 Persistent XSS POC In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. The vulnerability essentially exists on any wiki page which by default uses textile formatting. You can take advantage of it by using pre...

CVE-2023-37756-CWE-521-lead-to-malicious-plugin-upload-in-the-i-doit-Pro-25-and-below

CVE-2023-37756 – Weak Password Requirement in admin-center lead to malicious plugin upload in the i-doit Pro 25 and below i-doit Pro 25 and below are vulnerable to weak password requirement vulnerability in admin-center + malicious plugin upload lead to RCE vulnerability. These vulnerabilities...

CVE-2026-0594-ListSiteContributors-Plugin-Exploit

CVE-2026-0594-ListSiteContributors-Plugin-Exploit 🛡️ Description CVE-2026-0594 is a critical Reflected Cross-Site Scripting XSS vulnerability found in the List Site Contributors WordPress plugin. This exploit automates the discovery of vulnerable endpoints via the WordPress REST API wp-json and...

CVE-2024-3656

Keycloak 24.0.5 is vulnerable to Broken Access Control vulnerability, where the attacker can use any authenticated user to perform some api action such as : Test LDAP connections via the testLDAPConnection endpoint. Retrieve unmanaged attributes of any user via the getUnmanagedAttributes endpoint...

openvpn-install

openvpn-install OpenVPN installer for Debian, Ubuntu, Fedora, openSUSE, CentOS, Amazon Linux, Arch Linux, Oracle Linux, Rocky Linux and AlmaLinux. This script will let you setup and manage your own secure VPN server in just a few seconds. What is this? This script is meant to be run on your own...

p3-loader

P³-Shellcode Loader - Process Parameter Poisoning Authors: Max Hirschberger & Ogulcan Ugur Contents 1. Introduction 2. Typical Process Injection and Involved System APIs 3. Technical Foundation of Required Windows Internals 3.1 Process Creation API and Startup Parameters 3.2 The Process Environme...

OpenSTAManager_RCE_Exploit-CVE-2026-38751-

OpenSTAManager RCE Exploit CVE-2026-38751 Overview This Python script exploits a Remote Code Execution vulnerability in OpenSTAManager version 2.10, identified as CVE-2026-38751. The exploit allows authenticated users to upload a malicious module and execute arbitrary commands on the target syste...

CVE-2022-26937

PoC de Caída del Sistema de Archivos de Red de Windows CVE-2022-26937 root@kitploit: nt!KeBugCheckEx: fffff8038996efa0 48894c2408 mov qword ptr rsp+8,rcx ss:0018:ffffd000d589ae60=0000000000000139 1: kd !analyze -v Bugcheck Analysis KERNELSECURITYCHECKFAILURE 139 A kernel component has corrupted a...

robustbench

RobustBench: a standardized adversarial robustness benchmark Francesco Croce University of Tübingen, Maksym Andriushchenko EPFL, Vikash Sehwag Princeton University, Edoardo Debenedetti EPFL, Nicolas Flammarion EPFL, Mung Chiang Purdue University, Prateek Mittal Princeton University, Matthias Hein...

CVE-2023-47253

CVE-2023-47253 | Qualitor povoaVoComArray$REQUEST; if inarray$REQUEST'nmalias', array'dtiniciomesatual', 'dtfimmesatual', 'dtiniciomespassado', Proof of Concept POC Just access the URL with your PHP code in "gridValoresPopHidden" parameter...

PyShell

PyShell PyShell is Multiplatform Python WebShell. This tool helps you to obtain a shell-like interface on a web server to be remotely accessed. Unlike other webshells, the main goal of the tool is to use as little code as possible on the server side, regardless of the language used or the operati...

Stracciatella

Stracciatella v0.7 Powershell runspace from within C aka SharpPick technique with AMSI, ETW and Script Block Logging disabled for your pleasure. Nowadays, when Powershell got severly instrumented by use of techniques such as: AMSI ETW Script Block Logging Transcript file Modules logging Constrain...

badkeys

badkeys Tool and library to check cryptographic public keys for known vulnerabilities what? badkeys checks public keys in various formats for known vulnerabilities. A web version can be found at badkeys.info. install badkeys can be installed via pip: root@kitploit: pip3 install badkeys You may wa...

CVE-2026-65694-PoC

CVE-2026-65694 — Microweber CMS Unauthenticated Arbitrary File Read Proof-of-concept for CVE-2026-65694 , an unauthenticated path-traversal → arbitrary file read in Microweber CMS. An unauthenticated attacker can read any file the web-server user can access — the Laravel .env APPKEY, DB...