DIY-CVE-2026-42945-POC

Entorno de ejecución Docker con Ubuntu 22.04 + nginx 1.30.0 Este entorno compila nginx 1.30.0 desde el código fuente en Ubuntu 22.04 para pruebas HTTP locales. PHP-FPM se configura directamente en el Dockerfile porque nginx.conf reenvía las solicitudes PHP a /tmp/php-cgi-80.sock. Ejecutar...

exploit-CVE-2016-10034

PHPMailer 5.2.18 Ejecución remota de código PHPMailer es la clase de transporte más popular del mundo, con un estimado de 9 millones de usuarios en todo el mundo. Las descargas continúan a un ritmo significativo a diario. Utilizado por muchos proyectos de código abierto: WordPress, Drupal, 1CRM,...

CVE-2020-7247-reproducer

CVE-2020-7247 OpenSMTPD Información Este repositorio contiene los archivos necesarios para construir una imagen de Docker que contiene un entorno vulnerable de OpenSMTPD 6.6.1p1. La vulnerabilidad permite a un atacante ejecutar comandos arbitrarios a través de una sesión SMTP especialmente...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

EUVD-2026-65490

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch...

CVE-2026-79622

A path traversal vulnerability was identified in dekdee/adobe-xd-mcp version 1.0.0 , specifically in the file src/parsers/xd-parser.ts within the file-access-from-request Endpoint component. A remote attacker can manipulate the outputFile/outputDir argument to traverse the file system, leading to...

gitlab_rce_cve-2022-2884

gitlabrcecve-2022-2884 Este es un programa Python3 que explota la vulnerabilidad de RCE autenticada de GitLab conocida como CVE-2022-2884. DESCARGO DE RESPONSABILIDAD Esta herramienta está destinada a ingenieros de seguridad y personal de appsec para evaluaciones de seguridad. Úsela de manera...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Ejecución Remota de Código PHPMailer es la clase de transporte más popular del mundo, con un estimado de 9 millones de usuarios a nivel mundial. Las descargas continúan a un ritmo significativo diariamente. Usado por muchos proyectos de código abierto: WordPress, Drupal, 1CRM,...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

cve-2019-9193

CVE-2019-9193 • CVE-2019-9193 vulnerabilidad PostgreSQL tiene una vulnerabilidad que permite ejecutar código arbitrario dentro del sistema operativo de la base de datos a través de la funcionalidad "COPY TO / FROM PROGRAM" El vector de ataque es el Usuario que pertenece al grupo "SuperUser" y...

opsxcq-cve-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer es la clase de transporte más popular del mundo, con una estimación de 9 millones de usuarios en todo el mundo. Las descargas continúan a un ritmo significativo a diario. Utilizada por muchos proyectos de código abierto: WordPress, Drupal, 1CRM,...

DracOS

¿Qué es Dracos Linux? Dracos Linux www.dracos-linux.org es el sistema operativo Linux de Indonesia, de código abierto, construido basado en Linux From Scratch bajo la protección de la Licencia Pública General GNU v3.0. Este sistema operativo es una variante de las distribuciones de Linux, que se...

sharesniffer

sharesniffer sharesniffer is a network analysis tool for finding open and closed file shares on your local network. It includes auto-network discovery and auto-mounting of any open cifs and nfs shares. How to use Example to find all hosts on any local network with open/closed nfs/smb shares:...

caracal

Caracal Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries...

git-dumper

git-dumper A tool to dump a git repository from a website. Install This can be installed easily with pip: root@kitploit: pip install git-dumper Usage root@kitploit: usage: git-dumper options URL DIR Dump a git repository from a website. positional arguments: URL url DIR output directory optional...

gdb-frontend

GDBFrontend is an easy, flexible and extensionable gui debugger. Installing Requirements GDB = 8.2 with python3 python3 = 3.6 tmux PIP Package Python Wheel Recommended You can install GDBFrontend with pip. root@kitploit: sudo python3 -m pip install gdbfrontend if it is already installed and you a...

wappalyzergo

Wappalyzergo A high performance port of the Wappalyzer Technology Detection Library to Go. Inspired by Webanalyze. Uses data from https://github.com/enthec/webappanalyzer https://github.com/HTTPArchive/wappalyzer Features Very simple and easy to use, with clean codebase. Normalized regexes +...

USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

CVE-2026-70461

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

CVE-2026-76217 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents...