CVE-2026-89036

Appwrite before 2.0.0 contains an argument injection vulnerability in the providerRootDirectory parameter used to construct GNU tar commands. The root cause is the use of escapeshellcmd instead of escapeshellarg without proper quoting, allowing TAB characters to survive sanitization and be interp...

CVE-2026-89036 Appwrite < 2.0.0 Argument Injection via providerRootDirectory Parameter

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application...

r0ak

r0ak r0ak is a Windows command-line utility that enables you to easily read, write, and execute kernel-mode code with some limitations from the command prompt, without requiring anything else other than Administrator privileges. Quick Peek root@kitploit: r0ak v1.0.0 -- Ring 0 Army Knife...

Cve-api

Parse & filter the latest CVEs from https://cve.mitre.org Docs Usage http://localhost:4000/cve?target=KEYWORD The year parameter is optional. http://localhost:4000/cve?target=KEYWORD&year=YEAR Examples http://localhost:4000/cve?target=ruby%20on%20rails...

CVE-2023-36163

Exploit Title: BuildaGate5library - Reflected Cross-Site Scripting XSS Date: 06/07/2023 Exploit Author: Idan Malihi Vendor Homepage: None Version: 5 Tested on: Microsoft Windows 10 Pro CVE: CVE-2023-36163 PoC: An attacker needs to find the vulnerable parameter mc= and inject the JS code like: 'di...

CMD_Bypass_Assessment

CMD Bypass Method Analysis CMD Bypass Method Analysis is a PowerShell script that automatically tests CMD bypass methods on Windows systems and evaluates the results. The script checks for various CMD bypass methods and saves the results to a text file, providing security recommendations. Use To...

psc

PortShellCrypter -- PSC This project - as well as its sister project crash - belongs to my anti-censorship tool-set that allows to setup fully working encrypted shells and TCP/UDP forwarding in hostile censoring environments. It is also useful for forensics to dump data from devices via UART or...

CVE-2020-12077

CVE-2020-12077 MapPress Maps Pro 2.53.9 - Remote Code Execution RCE due to Incorrect Access Control in AJAX Actions Description The pro version of this plugin registers several AJAX actions that call functions which lack capability checks and nonce checks, specifically the ‘ajaxget’, ‘ajaxsave’,...

Arkhota

Arkhota, a web brute forcer for Android What? Arkhota is a web HTTP/S brute forcer for Android OS. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather...

SAFE

SAFE : Self Attentive Function Embedding Paper This software is the outcome of our accademic research. See our arXiv paper: arxiv If you use this code, please cite our accademic paper as: root@kitploit: @inproceedingsmassarelli2018safe, title=SAFE: Self-Attentive Function Embeddings for Binary...

Philips-PM-5139-5138A-5136-Firmware-Project

Philips PM5139 — 固件逆向工程 一台约 1994 年的 20 MHz 函数发生器，在软件层面被拆解：两份 EPROM 转储、一个被当作测量仪器使用的 8051 模拟器，以及 35 节文档，其中每一条论断都有清单地址、模拟器测量结果或原理图作为依据。 最终成果是一个 固件 V2.0 ，修复了 Philips 出厂时的一个缺陷， 六个我们自己的任意波形，以及一个逐条指令运行原始 ROM 的浏览器模拟器。 程序 EPROM 中的每一个波形表，直接从二进制中绘制出来。右下角那个 开启了本项目最有趣的部分。 目录 这是什么 结果一览 仪器 方法：模拟器即测量仪器 走到这里的路 精彩...

CVE-2024-0195-SpiderFlow

CVE-2024-0195 コード生成の不適切な制御（'コードインジェクション'）重大 2024 概要 CVE-2024-0195 は、spider-flow 0.4.3 Webアプリケーション、具体的には FunctionController.java の FunctionService.saveFunction 関数における重大なコードインジェクションの脆弱性です。攻撃者は、サーバー上で実行される悪意のあるコードをリモートから注入できます。これにより、アプリケーションが完全に侵害される可能性があります。 影響.. この脆弱性は、脆弱な spider-flow...

CVE-2020-6308

CVE-2020-6308 Exploit script for SAP Business Objects SSRF This is a simple Golang script to automate the exploitation of CVE-2020-6308. The original Github repo did not show any automation https://github.com/InitRoot/CVE-2020-6308-PoC , thanks @InitRoot, so this was made in an effort to help...

MultiPotato

MultiPotato First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the...

magicRecon

MagicRecon: Fast, simple and effective MagicRecon is a powerful shell script to maximize the recon and data collection process of an objective and finding common vulnerabilities, all this saving the results obtained in an organized way in directories and with various formats. With Magic Recon you...

mjet

MOGWAI LABS による MJET MOGWAI LABS JMX エクスプロイトツールキット MJET は sjet のフォークです。sjet は siberas によって開発されましたが、もはや積極的にはメンテナンスされていません。MJET は、オリジナルの sjet コードベースの大部分も提供した MOGWAI LABS チームによってメンテナンスされています。 MJET を使用すると、安全でない設定の JMX サービスを簡単に悪用できます。追加の背景情報は ここ と ここ にあります。 !!! 重要: このプロジェクトはメンテナンスされていません...

DCOMIllusionist

🎩✨🪄 DCOMIllusionist Windows fileless lateral movement technique. Introduction • Build • Usage • Technical Details • Acknowledgements Introduction This tool enables remote code execution on a Windows machine, if you have administrative privileges. It leverages DCOM and the behavior of .NET DCOM...

CVE-2023-39361

Cacti graphview.php SQL Injection Leads to RCE CVE-2023-39361 WHS 3rd - Nam Gichan7342 ChoDeokCheol Summary A vulnerability exists in the growrightpanetree function of the graphview.php file in Cacti 1.2.24. When the action parameter is set to treecontent, the user-supplied rfilter parameter is...

pgaudit

pgAudit Open Source PostgreSQL Audit Logging Introduction The PostgreSQL Audit Extension pgAudit provides detailed session and/or object audit logging via the standard PostgreSQL logging facility. The goal of pgAudit is to provide PostgreSQL users with capability to produce audit logs often...

CVE-2026-93014 RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...