INPGer

INPGer | CVE-2022-4063 - InPost Gallery Automatic Mass Tool for checking vulnerability in CVE-2022-4063 - InPost Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh...

terra

Terra : Terra needs an Active Maintainer I'm searching for an active maintainer for Terra. I have some exciting ideas for new features and other things possible with Terra / OSINT. Would love to hear from interested folks. Mail me at [email protected] Terra : Recon tool on Social Media...

exploitarium

https://discord.gg/WytKH65ZR join up for research, help, documentation, and more useful information for those interested. Statement This repo was incomplete when published. In regard to AI usage, my fuzzing workflow was automated by AI with a strict workflow. I used GPT-5.3 for ALL the fuzzing, a...

CVE-2026-60004

CVE-2026-60004 — Gitea Diffpatch Git Hook RCE Bare Clone Hook Injection → post-index-change → Arbitrary Command Execution Overview CVE-2026-60004 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Gitea and Forgejo self-hosted Git platforms, affecting versio...

ecapture

汉字 | English eCapture旁观者: capturar contenido de texto SSL/TLS sin un certificado CA usando eBPF. !IMPORTANT Compatible con Linux/Android en x8664 kernel 4.18+ y aarch64 kernel 5.5+. Los requisitos de versión del kernel varían según la arquitectura de la CPU tanto para Linux como para Android. Se...

XeytanWin32-RAT

WARNING This is a buggy RAT, not completed, not stable. It still a "work in progress" application. Introduction Project created to kill some of my free time, It is not actively maintained. There are a lot of things to improve/fix, and it will take time to reach a stability on this project. Featur...

oathkeeper

Chat · Discussions · Newsletter · Docs · Try Ory Network · Jobs Ory Oathkeeper is an Identity & Access Proxy IAP and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. It follows the BeyondCorp model designed by Google and secures applications in Zero-Trust...

ci_fuzz

Description: root@kitploit: This script fuzz's for Command Injection vulnerabilities resulting in remote command execution. Similiar OWASP vulnerablities are explained here -- https://www.owasp.org/index.php/CommandInjection The script will attempt to execute OS commands by injecting into every...

CVE-2022-45771

CVE-2022-45771 The PwnDoc is vulnerable to both path traversal and local file inclusion LFI, which allows unprivileged users to disclose JWT secrets and achive code execution. Requirements: An attacker has valid account with user role The application has a report template with either...

raxe-ce

Threat Detection for AI Agents Stop prompt injection, jailbreaks, and tool attacks before they execute. 100% local. Sub-5ms rule matching. Free forever. root@kitploit: pip install raxe && raxe scan "Ignore all previous instructions" Requires Python 3.10+ • 515+ rules + ML detection included Built...

hal

Welcome to HAL! HAL /hel/ is a comprehensive netlist reverse engineering and manipulation framework. Navigation 1. Introduction 2. Build Instructions 3. Quickstart Guide 4. Academic Context Introduction What the hell is HAL? Virtually all available research on netlist analysis operates on a...

xsscrapy

xsscrapy Fast, thorough, XSS/SQLi spider. Give it a URL and it'll test every link it finds for cross-site scripting and some SQL injection vulnerabilities. See FAQ for more details about SQLi detection. From within the main folder run: root@kitploit: ./xsscrapy.py -u http://example.com If you wis...

CVE-2025-48932-Invision-Community-SQLi-Exploit

🔓 CVE-2025-48932 - Invision Community SQL Injection Exploit ⚡ Critical Vulnerability Overview CVE-2025-48932 is a critical unauthenticated blind SQL injection vulnerability discovered in Invision Community versions ≤ 4.7.20. This exploit allows remote attackers to: 🔍 Extract sensitive database...

@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...

GHSA-2H44-8472-FRJJ @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Descripti...

spider

Spider The fastest web crawler and scraper for Rust. spider.cloud · Guides · Docs · Examples · Discord Spider is a concurrency-first crawling engine built in Rust. It streams pages the moment they arrive, renders JavaScript only when a page demands it, and scales from a single script to a...

h3-cli

NodeZero MCP Server The NodeZero MCP Server is now available, enabling you to run and manage a locally hosted MCP Server that brings NodeZero’s Find, Fix, Verify FFV capabilities directly to your development and security workflows. MCP Readme h3-cli: CLI tool for the Horizon3.ai API h3-cli is a...

CVE-2026-91939

Cotonti 1.0.0 Comments plugin passes the ci GET parameter directly to unserialize() without an allowed_classes restriction. This allows unauthenticated attackers to inject arbitrary PHP objects via crafted serialized payloads, triggering gadget chains that can lead to database manipulation or rem...

CVE-2026-91939 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...

EUVD-2026-80000

Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize without allowedclasses restriction, allowing unauthenticated attackers to instantiate arbitrary PHP classes with attacker-controlled properties. Attackers can exploit PHP object injection through crafted serialized payloads ...