CVE-2026-39324

CVE-2026-39324 Exploit PoC Rack::Session::Cookie-Entschlüsselungsfehler führt dazu, dass unverschlüsselte Cookies akzeptiert werden | ---|--- Advisory| GHSA-33qg-7wpp-89cq Paket| rack-session RubyGems Betroffen| = 2.1.1 Behoben| 2.1.2 Zusammenfassung Rack::Session::Cookie mit secrets: sollte nur...

CVE-2025-46817-PoC

CVE-2025-46817 Redis Integer Overflow Exploit Eine schlanke C-Implementierung des Exploits für die Redis-Integer-Overflow-Schwachstelle CVE-2025-46817. 🚀 Funktionen Schlank : Einzelne C-Datei, keine externen Abhängigkeiten außer hiredis Schnell : Native Kompilierung für maximale Leistung Farbige...

CVE-2026-31431

CVE-2026-31431 — „Copy Fail“ Lokale Privilegieneskalation im Linux-Kernel-Krypto-algifaead-Subsystem. Überblick CVE-2026-31431, genannt „Copy Fail“, ist ein Logikfehler in der kryptografischen Vorlage authencesn des Linux-Kernels algifaead. Er ermöglicht einem nicht privilegierten lokalen Benutze...

CVE-2026-31431-CopyFail-Universal-LPE

CVE-2026-31431 „Copy Fail“ — Universeller LPE-Exploit Linux-Kernel-Page-Cache 4-Byte-Arbitrary-Write → Lokale Privilegieneskalation Mehrere Exploit-Ansätze: dynamische ELF-Einstiegspunkt-Überschreibung, vollständiger Binärersatz, Python 3.x-kompatibel mit ctypes-splice-Fallback. Was ist das?...

MicroburstSecretsHunter

MicroBurst Secrets Hunter Ein PowerShell-Scanner, der MicroBurst-Ausgaben von Get-AzDomainInfo nach Klartext-Passwörtern, Schlüsseln, Verbindungszeichenfolgen und anderen Geheimnissen durchsucht, die niemals unverschlüsselt in einer Azure-Umgebung liegen sollten. Entwickelt für...

ApplicationInspector v1.10.1

Introduction Microsoft Application Inspector is a software source code characterization tool that helps identify coding features of first or third party software components based on well-known library/API calls and is helpful in security and non-security use cases. It uses hundreds of rules and...

Exploit for CVE-2026-18963

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detecto...

Dissecting-CVE-2026-0628-Chromium-Extension-Privilege-Escalation

= doi.org/10.5281/zenodo.18413764 = orcid.org/0009-0007-7728-256X root@kitploit: README.md CVE-2026-0628: Chromium WebView Privilege Escalation Origin Spoofing – Technische Forschung & Proof-of-Concept Autor: Sastra Adi Wiguna Purple Elite Teaming Forschungsdatum: Januar 2026 CVE-ID: CVE-2026-062...

CVE-2026-33715

CVE-2026-33715 — SSRF non autenticato + Open Email Relay in Chamilo LMS tramite install.ajax.php Gravità : Alta CVSS 7.5 CWE : CWE-918 SSRF + CWE-306 Autenticazione mancante Interessati : chamilo/chamilo-lms 2.0 commit 0195b29 e precedenti Advisory : GHSA-mxc9-9335-45mc NVD :...

tough-cookie-patch-cve-2023-26136

RFC6265 Cookie e CookieJar per Node.js Sinossi javascript var tough = require'tough-cookie'; var Cookie = tough.Cookie; var cookie = Cookie.parseheader; cookie.value = 'somethingdifferent'; header = cookie.toString; var cookiejar = new tough.CookieJar; cookiejar.setCookiecookie,...

CVE-2026-29909-MRCMS-vulnerability

CVE-2026-29909: MRCMS V3.1.2 - Enumerazione delle Directory Non Autenticata ID CVE CVE-2026-29909 Descrizione MRCMS V3.1.2 contiene una vulnerabilità di enumerazione delle directory non autenticata nel modulo di gestione dei file. L'endpoint /admin/file/list.do manca di controlli di autenticazion...

log4shellwithlog4j2_13_3

log4shellwithlog4j2133 Applicazione web Springboot che accetta un parametro get di nome e registra il suo valore in log4j2. Vulnerabile a CVE-2021-44228. compilare l'applicazione Springboot vulnerabile con mvn clean install eseguire l'applicazione Springboot con l'agente k2 con java --add-modules...

CVE-2026-33017-Exploit

CVE-2026-33017 - Esecuzione Remota di Codice Non Autenticata in Langflow root@kitploit: / \ | | \ ^ / ||||| exec senza autenticazione, senza sandbox, senza speranza. Langflow chat.py - startflowbuild - buildgraphfromdata - Graph.frompayload - loading.py - eval.py createclass - validate.py...

CVE-2021-43789

CVE-2021-43789 Prestashop = 1.7.5.0 1.7.8.2 - SQL injection POC root@kitploit: GET /prestashop1.7.8.1/admin860ykaqhn/index.php/sell/orders/?token=tPhFxoTyY8HLoCWbfVDKdY8Io1BVL3ZVebYNljeM9M&orderorderBy=idorder&ordersortOrder= AND SELECT 2331 FROMSELECT COUNT,CONCAT0,MIDIFNULLCASTCURRENTUSER AS...

CVE-2025-55315-detection-playground

Aqui estão alguns testes que podem ser realizados contra esses serviços para observar comportamentos diferentes nas rotas GET/POST entre as versões corrigida e não corrigida do Kestrel. GET contra a versão não corrigida envia 200 e o socket permanece aberto root@kitploit: printf 'GET /...

CVE-2021-22204-exiftool

CVE-2021-22204-exiftool Exploit em Python para a vulnerabilidade CVE-2021-22204 no Exiftool. Tutorial em vídeo Youtube root@kitploit: 404 não encontrado Requisitos root@kitploit: python3 python3-pip djvulibre-bin exiftool Instalar requisitos Debian root@kitploit: apt-get install djvulibre-bin...

semgrep v1.175.0

Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...

go-dbmigrate

migrate Un helper per le migrazioni scritto in Go. Usalo nel tuo codice Golang esistente oppure esegui i comandi tramite la CLI. root@kitploit: GoCode import github.com/mattes/migrate/migrate CLI go get -u github.com/mattes/migrate Caratteristiche Estremamente semplice da implementare con...

CVE-2023-6567-poc

CVE-2023-6567-poc समय-आधारित SQLi विवरण यह प्लगइन SQL स्टेटमेंट में उपयोग करने से पहले orderby पैरामीटर को ठीक से सैनिटाइज़ और एस्केप नहीं करता है, जिससे SQL इंजेक्शन होता है जिसका शोषण बिना प्रमाणीकरण वाले उपयोगकर्ता कर सकते हैं 1. संवेदनशील GET अनुरोध:...

ResourcePoison

La correzione per questo problema è apparsa come CVE-2025-22441: bollettino patch follow up Passare ApplicationInfo in giro ApplicationInfo è una struttura che definisce varie informazioni sull'app installata, in particolare il percorso del file apk da cui vengono caricati risorse e codice Di...