SQLI

SQL Injection Exploitation Toolkit Complete Bug Bounty • Pe...

TALKINGEBN

|-------------------| TALKINGBEN : --- Un malware BootKit que primero realiza una escalada de privilegios en la máquina víctima. Utilizando parcheo en NtTraceEvent y AMSI escáner de búfer de memoria, lo que le permite evadir Windows Defender y cargar un payload sin ser detectado. Luego usamos...

agentic-dm-gateway — Updated!

Agentic DM Gateway Security control plane for LLM agents over private chat typically Discord DMs. It sits in front of your agent. It decides who may talk, whether the session is unlocked, whether the process is paused, and whether this message is safe enough to forward. Your model and tools stay...

CVE-2026-1492

CVE-2026-1492 - WordPress User Registration Plugin Privilege Escalation Exploit Description This repository contains a proof-of-concept exploit for CVE-2026-1492 , a critical vulnerability affecting the WordPress User Registration & Membership plugin. The vulnerability allows unauthenticated...

iVANTI-CVE-2021-38560

iVANTI-CVE-2021-38560 Ivanti Service Manager 2021.1 infected with reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx. Vulnerability Type: Cross Site Scripting XSS Vendor of Product: IVANTI Affected Product Versions: Service Manager - =...

CVE-2026-35517

CVE-2026-35517 - Pi-hole FTLDNS Remote Code Execution via Newline Injection TL;DR A Remote Code Execution vulnerability in Pi-hole's FTLDNS engine versions 6.0 through 6.5 allows an authenticated attacker to inject arbitrary dnsmasq configuration directives by embedding newline characters \n into...

CVE-2026-5281-CVE-2026-11057-fullchain

CVE-2026-5281+CVE-2026-11057 Android fullchain Device Pixel 7 Android 16 ARM64 Chromium version root@kitploit: commit 994c846bbd7a35241ba7c08158c13d66412a6993 HEAD - 146.0.7680.111, tag: 146.0.7680.111 Author: Roger McFarlane Date: Mon Mar 9 12:48:07 2026 -0700 Description Exploitation approach...

CVE-2026-30695

CVE-2026-30695 - XSS in Zucchetti Axess Summary A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices XA4, X3/X3BIO, X4, X7, XIO, i-door, i-door+. The vulnerability is caused by improper sanitization of user-supplied...

CVE-2026-26331

Arbitrary Command Injection via --netrc-cmd in yt-dlp Severity: High CVSS 8.8 Affected Software: yt-dlp = 2023.06.21, Patched In: 2026.02.21 Advisory: GHSA-g3gw-q23r-pgqm CVE: CVE-2026-26331 Summary yt-dlp’s --netrc-cmd command-line option or netrccmd Python API parameter can be abused to achieve...

CVE-2026-34940

CVE-2026-34940 — OS Command Injection in KubeAI via Model URL in Ollama startup probe Severity : High CVSS 8.7 CWE : CWE-78 — Improper Neutralization of Special Elements used in an OS Command Affected : github.com/kubeai-project/kubeai /tmp/pwned execute insid...

CVE-2025-11391

Unauthenticated Blind SQL Injection in PPOM for WooCommerce = 33.0.15 This repository contains a Proof of Concept PoC for an unauthenticated time-based blind SQL Injection vulnerability in the "PPOM for WooCommerce" WordPress plugin, affecting versions up to and including 33.0.15. Vulnerability...

CVE-2021-43789

CVE-2021-43789 Prestashop = 1.7.5.0 1.7.8.2 - Inyección SQL POC root@kitploit: GET /prestashop1.7.8.1/admin860ykaqhn/index.php/sell/orders/?token=tPhFxoTyY8HLoCWbfVDKdY8Io1BVL3ZVebYNljeM9M&orderorderBy=idorder&ordersortOrder= AND SELECT 2331 FROMSELECT COUNT,CONCAT0,MIDIFNULLCASTCURRENTUSER AS...

exploit-CVE-2026-2670

exploit-CVE-2026-2670 CVE-2026-2670 – Advantech WISE-6610 Command Injection PoC Proof-of-concept exploit demonstrating a command injection vulnerability in the Advantech WISE-6610 industrial cellular router. The vulnerability exists in the /cgi-bin/luci/admin/openvpnapply endpoint and allows an...

CVE-2026-0709

Hikvision Wireless AP – CVE-2026-0709 Authenticated RCE Tool This tool is a Python proof‑of‑concept to test Hikvision wireless access points for CVE‑2026‑0709 , an authenticated command injection vulnerability that can lead to remote code execution on affected devices. For security testing and...

EUVD-2026-70302

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

POC-CVE-2026-1357

CVE-2026-1357 WPvivid Backup & Migration RCE PoC Descubierto por: Lucas Montes NiRoX Vulnerabilidad: Subida de archivos arbitraria sin autenticación que conduce a Ejecución Remota de Código RCE ID CVE: CVE-2026-1357 CVSS: Crítico 9.8 Estado: Parcheado en la versión 0.9.124 Resumen Este repositori...