CVE-2022-46152

CVE-2022-46152 OP-TEE OScleanupshmrefs Out-of-Bounds Read — Reproduction Environment Reference: https://optee.readthedocs.io/en/latest/building/devices/qemu.htmlqemu-v8 Security Advisory: https://github.com/OP-TEE/opteeos/security/advisories/GHSA-65w8-6mrg-52g7 Vulnerability Overview Field| Detai...

CVE-2026-41940

⚠️ CVE-2026-41940 - cPanel & WHM Authentication Bypass Critical Pre-Authentication Bypass in cPanel & WHM 📌 Overview CVE-2026-41940 is a critical authentication bypass vulnerability affecting cPanel & WHM and WP Squared. An unauthenticated remote attacker can completely bypass login and gain full...

CVE-2025-11371

CVE-2025-11371 In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet...

goblob

Goblob 🫐 Goblob is a lightweight and fast enumeration tool designed to aid in the discovery of sensitive information exposed publicy in Azure blobs, which can be useful for various research purposes such as vulnerability assessments, penetration testing, and reconnaissance. Warning. Goblob will...

CVE-2022-28672

CVE-2022-28672 CVE-2022-28672 Foxit PDF Reader Vulnerability - UaF - RCE - JIT Spraying FortiOS, FortiProxy and FortiSwitchManager Authentication Bypass IOC CVE-2022-40684 Introduction The recent FortiOS / FortiProxy / FortiSwitchManager CVE has been exploited in the wild. We would like to provid...

Apache-Struts

Apache-Struts An exploit for Apache Struts CVE-2017-5638 Usage Testing a single URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Nmap Recong nmap -p --script http-vuln-cve2017-5638 ' Testing a list of URLs. python struts-pwn.py --list 'urls.txt' -c 'id'...

gospider

GoSpider GoSpider - Rápido rastreador web escrito en Go ¿Integrar Gospider sin complicaciones en tu flujo de trabajo de reconocimiento? este proyecto fue parte de Osmedeus Engine. Mira cómo fue integrado en @OsmedeusEngine Instalación Instalación con GO root@kitploit: GO111MODULE=on go install...

platform_external_libvpx_v1.4.0_CVE-2023-5217

README - 23 March 2015 Welcome to the WebM VP8/VP9 Codec SDK! COMPILING THE APPLICATIONS/LIBRARIES: The build system used is similar to autotools. Building generally consists of "configuring" with your desired build options, then using GNU make to build the application. 1. Prerequisites...

CVE-Requests-1896609

CVE Requests 1896609 - feiskyer/mcp-kubernetes-server Executive Summary This report details two critical security vulnerabilities discovered in the feiskyer/mcp-kubernetes-server package. When deployed, the server exposes an MCP tool named kubectl which is intended to provide limited, safe access...

iCSeeU

This is a suite of tools/PoCs/exploits that can be used iCSee video-call cameras via LAN and maybe non-video call cameras as well. This could easily be used to flash alternative firmwares as a replacement for the SD card update method. Note: Any memory corruption exploit will only work if your...

DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

CVE-2025-30208

中文 | English Vite Dev Server Vulnerability Scanner 一个内外网通吃的自动化扫描器 An automated tool for scanning Vite development server vulnerabilities. This tool utilizes the FOFA API to collect potential targets and automatically detects specific vulnerabilities. Features Auto Automatic target asset collectio...

CVE-2022-1388-Exploit-POC

CVE-2022-1388 EXPLOIT POC F5 BIG IP root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: REDACTED:8083 Content-Length: 45 Connection: Keep-Alive,X-F5-Auth-Token Cache-Control: max-age=0 X-F5-Auth-Token: SherlockSecure Content-Type: application/json Authorization: Basic YWRtaW46aG9yaXpvbjM=...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

popeye

Popeye: Linter de clústeres Kubernetes en vivo Popeye es una utilidad que escanea clústeres Kubernetes en ejecución e informa posibles problemas con los recursos y configuraciones desplegados. A medida que el panorama de Kubernetes crece, se vuelve un desafío para un humano hacer seguimiento de l...

enseal

enseal Secure, ephemeral secret sharing for developers. Stop pasting secrets into Slack. enseal makes the secure path faster than the insecure one — share .env files and secrets through encrypted, single-use channels with one command and zero setup. root@kitploit: sender $ enseal share .env Share...

CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata in the Settings- Global Settings Menu. Attack Vectors: Scripting A vulnerability...

WordPress iTracker360 plugin <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itrackerlicense' Settings Field vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin iTracker360 versions = 2.2.0...

CVE-2024-29849

CVE-2024-29849 Veeam Backup Enterprise Manager Authentication Bypass CVE-2024-29849 by Sina Kheirkhah @SinSinology of SummoningTeam @SummoningTeam Technical Analysis A root cause analysis of the vulnerability can be found on my blog Summary Supported versions? According to Veeam official advisory...

cve-2026-3359-exp

CVE-2026-3359 is an unauthenticated SQL Injection vulnerability situated within Web10's wordpress plugin "Form Maker" in all versions up to version 1.15.42. In order to use this PoC/exploit, first set up a virtual enviroment through the commands "virtualenv name of your enviroment here" or "venv...