heartbleed

HEARTBLEED : OpenSSL TLS HEARTBLEED VULNERABILITY OpenSSL TLS Heartbeat Extension - Memory Disclosure - Multiple SSL/TLS versions vulnerability scanner and exploit need: root@kitploit: sudo apt-get install nmap lolcat java root@kitploit: sudo apt install default-jre default-jdk...

CVE-2026-84373

A flaw was found in Vitest, a testing framework. A remote attacker, able to reach an exposed development server, could exploit an issue in the mockerPlugin and interceptorPlugin exports. These plugins register a handler on Vite's unauthenticated HMR WebSocket without properly validating redirect...

CVE-2023-34843

CVE-2023-34843 Disclosure traggo/server version 0.3.0 is vulnerable to directory traversal. Steps to reproduce: 1. Setup traggo/server on your endpoint/server. https://traggo.net/install/ 2. Make a GET request to the following URL. curl -X GET...

xpl-ModernWMS-CVE-2024-57698

Admin MD5 Password Hash Disclosure - ModernWMS v1.0 - CVE-2024-57698 An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial configuration and password change. This happens due to excessive...

CVE-2026-84641

Mozilla Thunderbird is affected by an information disclosure vulnerability in its IMAP client. A malicious IMAP server can send a crafted ID response that triggers a use-after-free , leading to heap-memory disclosure . The disclosed heap contents can ultimately be persisted to the user's prefs.js...

CVE-2021-41773

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 Usage root@kitploit: python3 apache2-4-49.py -h python3 apache2-4-49.py --check --single example.com Reference...

CVE-2021-41773

CVE-2021-41773 Playground This is a small Docker recipe for setting up a Debian bookworm based container with an instance of the Apache HTTPd 2.4.49 that is vulnerable to CVE-2021-41773. CGI has been explicitly enabled so it can be used to test/verify Local file Disclosure behavior as well as...

CVE-2022-31890

CVE-2022-31890 for osTicket | Support Ticketing System Nickname: root@kitploit: python nickname.py The output of the first nickname in the table. Password: root@kitploit: python password.py The output of the first password in the table. Output to file: root@kitploit: python dumpFile.py cat dump.t...

CVE-2001-0934

CVE-2001-0934 Cooolsoft PowerFTP Server 2.03 allows remote attackers to obtain the physical path of the server root via the pwd command, which lists the full pathname. Securiteam publication at http://www.securiteam.com/exploits/6D00L2A35K.html External info at...

wordpress-snapcreek

wordpress-snapcreek snapcreekduplicator file read vulnerability https://www.cvedetails.com/cve/CVE-2020-11738/ Step1: Open MSFconsole: and use wordpressscanner to find all plugins used by target machine. STEP2: Attack using python script: Install/ upgrade pip3 on attacker machine Sudo apt install...

CVE-2021-21042

CVE-2021-21042 Inspired from https://www.zerodayinitiative.com/blog/2021/2/17/zdi-21-171-getting-information-disclosure-in-adobe-reader-through-the-id-tag...

CVE-2024-31320-

CVE-2024-31320- Get GeoLocation of Exploited Device using CVE-2024-31320& bluetooth...

RomBuster

RomBuster RomBuster is a router exploitation tool that allows to disclosure network router admin password. Features Exploits vulnerabilities in most popular routers such as D-Link, Zyxel, TP-Link, Cisco and Huawei. Optimized to exploit multiple routers at one time from list. Simple CLI and API...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

CVE-2019-8449

CVE-2019-8449 Proof Of Concept Exploit for CVE-2019-8449 Jira 8.4.0 User Enumeration Detail: https://www.cvedetails.com/cve/CVE-2019-8449/ Usage $ go run CVE-2019-8449.go -f USERFILE.txt -p 8080 -u example.com...

kygocera

kygocera CVE-2022-1026 Improved Golang Version of Rapid7 PoC for CVE-2022-1026 https://www.rapid7.com/blog/post/2022/03/29/cve-2022-1026-kyocera-net-view-address-book-exposure/ credits to Aaron Herndon / https://twitter.com/ac3lives greets to https://github.com/D4RKMATT3R CVE-2022-1026 install...

CVE-2018-9995_dvr_credentials

Tool show DVR Credentiales root@kitploit: Exploit Title: "Gets DVR Credentials" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Exploit Author: Fernandez Ezequiel twitter:@capitanalfa Exploit: root@kitploit: $ curl...

CVE-2025-5777

CVE-2025-5777 - Citrix NetScaler Memory Leak PoC 📌 Description This script exploits a critical memory disclosure vulnerability in Citrix NetScaler ADC/Gateway appliances, identified as CVE-2025-5777 dubbed CitrixBleed 2. It triggers a memory leak through the /p/u/doAuthentication.do endpoint,...

CVE-2025-49132_poc

CVE-2025-49132poc Usage Examples 1. Scan a single target : root@kitploit: python3 CVE-2025-49132poc.py -u http://pterodactyl.example.com 2. Scan a list of targets : root@kitploit: python3 CVE-2025-49132poc.py -f targets.txt 3. Save scan results : root@kitploit: python3 CVE-2025-49132poc.py -f...

CVE-2023-36643

== Affected Software %hardbreaks Vendor: ITB-GmbH Affected Products: TradePro v9.5 Component: Function Customer; Action oordershow Confirmed: yes == Attack Vector %hardbreaks Type: Incorrect Access Control Access-Type: Remote Impact: Information Disclosure Incorrect Access Control in function...