CVE-2019-11932

CVE-2019-11932 The address of system and the gadget must be replaced by the actual address found by an information disclosure vulnerability. After replacing address of system and gadget. Run the code to generate the corrupted GIF file: root@kitploit: notroot@osboxes:/Desktop/gif$ make...

PT-2026-86960

SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative functionality or interface and obtain sensitive information about the system state, resulting in information disclosure. This disclosed...

PT-2026-86958

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CHARON

root@kitploit: / || | | | / \ | \ / | \ | | | | | || | / \ | | | | | | | | | | | |/ | "落入永生神的手中是一件可怕的事。" — 希伯来书 10:31 这是什么 一个紧凑、无依赖的 CVE-2026-46333 概念验证：Qualys 于 2026-05-15 披露的 ptracemayaccess mm==NULL 绕过。Charon 将 pidfdgetfd2 与一个正在退出的 SUID-root 进程进行竞态， 以在其 doexit 中短暂的 mm-NULL 窗口期间提取其打开的...

CVE-2022-1077

CVE-2022-1077 Description A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated remotely an...

CVE-2016-10140-Zoneminder-Poc

ZoneMinder Unauthorized Access CVE-2016-10140 Poc -- Batch Verification Script Vulnerability Description ZoneMinder is an open-source video surveillance system. When abnormal events occur, you can receive email or SMS notifications. There is an information disclosure and authentication bypass...

CVE-2001-0933

CVE-2001-0933 Cooolsoft PowerFTP Server 2.03 allows remote attackers to list the contents of arbitrary drives via a ls LIST command that includes the drive letter as an argument, e.g. "ls C:". Securiteam publication at http://www.securiteam.com/exploits/6D00L2A35K.html External info at...

Cortex-XDR-Config-Extractor

Cortex XDR Config Extractor ⚠️ For more information, please visit https://laokoon-security.com/cortex-xdr-config-exctractor/ currently in German only This tool is meant to be used during Red Team Assessments and to audit the XDR Settings. With this tool its possible to parse the Database Lock File...

Joomla-v4.2.8---CVE-2023-23752

Joomla! v4.2.8 - Unauthenticated Information Disclosure Exploit Script This Bash script exploits an unauthenticated information disclosure vulnerability in Joomla! versions 4.0.0 to 4.2.8. root@kitploit: sudo apt-get update sudo apt-get install jq ./exploit.sh http://example.com...

CVE-2024-24919-Bulk-Scanner

CVE-2024-24919 Bulk Scanner CVE-2024-24919 Check Point Security Gateway Information Disclosure Script based on and the credit goes to: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ This Python script scans lisy of URLs for CVE-2024-24919 vulnerability by sending specifi...

HijackLibs

HijackLibs 该项目旨在记录公开披露的 DLL 劫持机会。 您可以在 https://www.hijacklibs.net 上找到此仓库的网页版本。 许可证 : GPLv3.0 行为准则 : Contributor Covenant 贡献指南 YAML Schema 项目使用的模式 YAML 模板示例 HijackLibs Helper 由 @JPMinty 开发...

CVE-2020-1958

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injection vulnerability in Apache Druid 0.17.0. It allows an attacker to bypass LDAP search filter and to retrieve any LDAP attribute values of users that exist on the LDAP server. From official Apache Druid advisory: When LDAP authentication ...

CVE-2019-5418

CVE-2019-5418 - Rails 中的文件内容泄露 编辑注 ：此 CVE 可能导致远程代码执行，更多信息：https://github.com/mpgn/Rails-doubletap-RCE Action View 中存在一个可能的文件内容泄露漏洞。 特制的 Accept 头与对 render file: 的调用相结合， 可导致目标服务器上的任意文件被渲染， 从而泄露文件内容。 影响仅限于在未指定 accept 格式时渲染文件内容的 render 调用。 控制器中受影响的代码 大致如下： 由 GitHub 的 John Hawthorn 发现 技术分析 ：...

cve-2021-42013-docker-lab

CVE-2021-42013 简介 人们发现，Apache HTTP Server 2.4.50 中对 CVE-2021-41773 的修复并不充分。攻击者可以利用路径遍历攻击，将 URL 映射到由类似 Alias 的指令所配置目录之外的文件。如果这些目录之外的文件未受到通常默认配置“require all denied”的保护，这些请求就可能成功。如果这些别名路径还启用了 CGI 脚本，则可能导致远程代码执行。此问题仅影响 Apache 2.4.49 和 Apache 2.4.50，不影响更早版本 1。 用于演练/学习 CVE-2021-42013 的 Docker 容器实验室 1...

GoogleIndexRetriever

Google index Retriever Have you ever found a webpage that seems to talk exactly about what you need, but it has been removed? Yes, Google cache is the answer but... What if the cache has been removed too? What if the site is just in Google Index page? You can not get the webpage back, but you kno...

netscaler-saml-memory-disclosure-security-assessment

CVE-2026-8451 - Citrix NetScaler SAML 内存越界读取 CitrixBleed 顾问式网络安全报告 关于 NetScaler SAML 内存泄露风险的专业漏洞评估报告，包括技术影响、修复和缓解策略。 📍 报告概览 字段| 详情 ---|--- 报告类型| 漏洞评估报告 参与背景| 安全研究 主要关注点| 网络边缘安全 目标读者| 安全团队、工程团队、招聘经理 输出风格| 执行摘要、技术分析、业务影响、修复路线图 发布状态| 已脱敏，供公开作品集审查 !IMPORTANT 本报告特意进行了脱敏处理，以便在 GitHub...

CVE-2020-15931

CVE-2020-15931 Netwrix Account Lockout Examiner 4.1 Domain Admin Account Credential Disclosure Vulnerability Vulnerbility Overview Netwrix Account Lockout Examiner ALE before 5.1 allows an unauthenticated, remote adversary to trigger a connection to an attacker-controlled system and capture the...

CVE-2007-6638

CVE-2007-6638 March Networks DVR 3204 - Logfile Information Disclosure Exploit-DB publication at https://www.exploit-db.com/exploits/4797/ Author Alex Hernandez aka @alt3kx...

RepoReaper

RepoReaper Overview RepoReaper is a precision tool designed to automate the identification of exposed .git repositories across a list of domains and subdomains. By processing a user-provided text file with domain names, RepoReaper systematically checks each for publicly accessible .git files. Thi...

CVE-2000-0649

CVE-2000-0649 CVE-2000-0649 is a low risk vulnerability that can potentially disclose the internal IP addresses of the server. Official details are here: Rapid7 CVE NIST This particular vulnerability became of interest to me because it seems to affect current NGINX and some Apache setups as well...