CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized organization registration via improper invitation token validation Disclaimer This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer syste...

CVE-2023-32629

CVE-2023-32629 — OverlayFS Local Full Privilege Escalation OverlayFS Local Privilege Escalation - Full write-up to full escalation For educational and authorized security research purposes only. Severity: High Type: Local Privilege Escalation LPE Affected: Ubuntu kernels prior to May/June 2023...

shell-history-leaks

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install shell-history-leaks Run bellow command to check shell-history-leaks -h Configurations 2. We integrated with the...

laravel-ignition-Rxss

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip root@kitploit: pip install laravel-ignition-rxss Run bellow command to check laravel-ignition-rxss -h Configurations 2. We integrated with...

Grav CMS vulnerable to remote code execution via .zip file upload

Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...

EUVD-2026-58633

Grav CMS vulnerable to remote code execution via .zip file upload...

GHSA-R94F-HX44-8JQF Grav CMS vulnerable to remote code execution via .zip file upload

Summary A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair o...

Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...

GHSA-XHFV-7758-R9HX Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Summary The core Flex group blueprint system/blueprints/user/group.yaml access field, lines 48-55 omits the security@: admin.super field guard that its sibling account blueprint carries account.yaml:131/138/150, added by the CVE-2026-42613 fix. A delegated non-super operator holding...

IvantiInitrdDecryptor

Here's a quick-and-dirty tool to decrypt the Ivanti device's initrd. It's mostly academic since there are other ways to extract the much more useful LVM keys for the real root device. To use it, copy the kernel file from the Ivanti, and extract the ELF from the bzImage I used binwalk -e. Throw it...

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...

GHSA-Q2J8-X8HF-63CH Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...

cabir_analysis

description: Bluetooth-Worm:SymbOS/Cabir Analysis Bluetooth-Worm:SymbOS/Cabir Analysis Before you start reading , i have to do this announcement : PLEASE TAKE EVERYTHING YOUR READ WITH A PINCH OF SALT AS I'M NO WHERE A SymbianOS developer or anything familiar with SymbianOS environment But why ev...

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...

GHSA-F8WV-XP27-6GQ7 Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Sinks: - system/src/Grav/Common/Data/Blueprint.php:455-458 calluserfuncarray$o, $params bare-function dynamic-data provider. - Twin: system/src/Grav/Framework/Flex/FlexDirectory.php:936-938...

EUVD-2026-60591

Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits errorlog, giving arbitrary file write...

Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...

GHSA-4V9Q-P283-QC2M Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...

Learning-History-of-CFF-bug-in-iphone

Learning-History-of-CFF-bug-in-iphone Dive into CFF font and coincidently learn about a bof in cff parsing from some jailbreak. just for fun So.... wtf is CFF ? So from my knowledge it's a file format , but let's try to understad what wikipedia says:"CFF acts as a container to store multiple font...

CVE-2018-16763-Fuel-CMS-1.4.1-Remote-Code-Execution-PoC

CVE-2018-16763 — Fuel CMS 1.4.1 Remote Code Execution PoC Unauthenticated RCE vulnerability in Fuel CMS 1.4.1. The filter parameter in the /fuel/pages/select/ endpoint is passed unsanitized to a eval call in the PHP backend, allowing arbitrary code execution via a crafted payload. Unlike blind...