CVE-2026-14856-TastyIgniter

CVE-2026-14856: Stored XSS to Account Takeover in TastyIgniter v4.3.0 📌 Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the file upload functionality of the Media Manager in TastyIgniter v4.3.0. Due to insufficient validation and sanitization of uploaded .svg files, an...

CVE-2025-60574

Vulnerability Discoverers & Exploit Authors Stefano Andreatta & Jacopo Candido Augelli CVE-2025-60574 Vulnerability Description A Local File Inclusion LFI vulnerability has been identified in tQuadra CMS 4.2.1117. The issue exists in the "/styles/" path, which fails to properly sanitize...

st2-046-poc

Variante de nombre de archivo Content-Disposition con byte nulo de CVE-2017-5638 Boletín de seguridad de Struts2 S2-046 Un byte nulo \x00 en el campo de nombre de archivo del encabezado Content-Disposition de una solicitud puede desencadenar una InvalidFileNameException con la misma cadena de...

CVE-2026-3576

CVE-2026-3576 - Wordpress Plugin Planyo Online Reservation System = 3.0 - Arbitrary File Read via SSRF This repo contains a python based Proof of ConceptPoC exploit for CVE-2026-3576. It can also be found in Exploit-DB here. I have also developed a Metasploit module for this exploit which can be...

Malicious code in external_deps_enjoyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6 package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather tha...

Malicious code in easypanel-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f The package's preinstall lifecycle script preinstall.js executes automatically on npm install and collects the installer's hostname, OS username,...

Malicious code in easypanel-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8 The package's preinstall lifecycle script runs automatically on npm install and collects installer-side identifiers — os.hostname,...

poc-rebar3

Rebar3 shell injection CVE-2020-13802 Proof of concept root@kitploit: git clone https://github.com/vulnbe/poc-rebar3.git cd poc-rebar3 rebar3 clean Credit Alexey Pronin @vulnbe References Rebar3 vulnerability analysis Vulnerability remediation PR CVE-2020-13802 CWE-78: Improper Neutralization of...

Malicious code in easypanel-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef6da51fcc215c514680417cfd3bacb5725b91a5b4a058fd6d2b161106209b0 The package ships an empty library body index.js exports and a preinstall lifecycle script that runs automatically on npm install. The preinstall...

copyfail-go

CopyFail Go Most Linux LPEs need a race window or a kernel-specific offset. Copy Fail is a straight-line logic flaw — it needs neither. The same 732-byte Python script static Go binary roots every Linux distribution shipped since 2017. A Go implementation of CVE-2026-31431. In case you need a...

CVE-2024-4577

CVE-2024-4577 Argument injection vulnerability in PHP INSTALL git clone https://github.com/gotr00t0day/CVE-2024-4577.git cd CVE-2024-4577 pip3 install -r requirements.txt USAGE root@kitploit: Scan A Target python3 CVE-2024-4577.py -t https://160.153.61.66/ -c "" Scan a list of Targets python3...

CVE-2022-26809

CVE-2022-26809 This repo just simply research for the CVE, for more detailed ananlysis,please refer here. UPDATE:05/19 2022 This ananlyze hasn't been finished yet.... UPDATE:05/22 2022 HuanGMz Post and corelight blog show the real vulnerable point: OSFCASSOCIATION::ProcessBindAckOrNak This...

Malicious code in easypanel-hosting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db6a378b33bb2f33088ed90db4ac48e81368e30d5ef38578dca3b4345e9cb06b [email protected] ships a stub index.js module.exports = and an npm preinstall lifecycle script that collects the installer's hostname, usernam...

inspect_petri

Inspect Petri Bienvenido a Inspect Petri, un agente de auditoría que permite la supervisión e interacción automatizada con modelos de lenguaje para detectar posibles problemas de alineación, manipulación de recompensas y otros comportamientos preocupantes. Petri te ayuda a probar rápidamente...

cve-2025-29927

This is a sample Next.js project bootstrapped with create-next-app for practically explaining how cve-2025-29927 works. https://nextjs.org/docs/app/api-reference/cli/create-next-app. Getting Started First, run the development server: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev...

SUDO_KILLER

⭐ Danos una estrella en GitHub — para mostrar tu apoyo! 💡 Mejor visualizado en modo oscuro : El proyecto SUDOKILLER llegó a la final del SANS Difference Award 2023 en la categoría de herramienta de código abierto. Contribuyendo Stargazers a lo largo del tiempo Soporte Créditos Descargo de...

awesome-incident-response

Awesome Incident Response A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams. Digital Forensics and Incident Response DFIR teams are groups of people in an organization responsible for managing the response to a security incident,...

SiteCore-RCE-Detection

SiteCore-RCE-Detection For detection of sitecore RCE - CVE-2021-42237 Sitecore Experience Platform Pre-Auth RCE - CVE-2021-42237 Relies on sitecore version detection and response when a request is made to vulnerale Report.ashx via Get and Post. The script takes a file containing list of urls in...

MASS-CVE-2024-27956

MASS-CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage root@kitploit: git clone...

nerva v1.69.6

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...