GoDefender

🛡️ GoDefender 🛡️ Un potente toolkit di sicurezza basato su Go, progettato per rilevare e difendere da attacchi di debug, virtualizzazione e DLL injection. GoDefender fornisce meccanismi di protezione completi per rendere il reverse engineering e l'analisi significativamente più difficili. ⚠️ SOLO...

CVE-2020-26733

CVE-2020-26733 SKYWORTH GN542VF Hardware-Version 2.0 und Software-Version 2.0.0.16 Cross-Site-Scripting XSS-Schwachstelle Beschreibung Cross-Site-Scripting XSS auf der Konfigurationsseite in SKYWORTH GN542VF Hardware-Version 2.0 und Software-Version 2.0.0.16 ermöglicht es einem authentifizierten...

CVE-2025-7775-PoC

CVE-2025-7775 | NetScaler ADC RCE PoC root@kitploit: ⚠️ Disclaimer: questo è un PoC ipotetico solo per scopi didattici. Segmentare le reti NetScaler. CVE-2025-7775 non esiste. Utilizzare solo in un laboratorio isolato. Panoramica Exploit simulato per una RCE non autenticata e ipotetica in Citrix...

CVE-2025-57833

Django FilteredRelation Alias: vulnerabilità SQL injection CVE-2025-57833 A distanza di un anno, Django ha visto emergere una vulnerabilità SQL injection; a prima vista sembra un'iniezione causata dagli alias dato che gli alias non possono essere precompilati. La vulnerabilità interessa la...

DumpChromeSecrets

!IMPORTANT Dieses Projekt wird nicht mehr gewartet. Bitte verwenden Sie stattdessenDumpBrowserSecrets, das Chrome, Edge, Brave, Firefox, Opera, Opera GX und Vivaldi unterstützt. DumpChromeSecrets Extrahiert Daten aus modernen Chrome-Versionen, einschließlich Refresh-Tokens, Cookies, gespeicherter...

CVE-2022-46169_unauth_remote_code_execution

CVE-2022-46169 - Esecuzione di codice remoto non autenticata in Cacti Esecuzione di codice remoto non autenticata attraverso bypass dell'autenticazione e iniezione di comandi in Cacti 1.2.23 e 1.3.0 DICHIARAZIONE DI NON RESPONSABILITÀ: Questo script è realizzato per verificare la sicurezza dei...

react2shellpoc

This repository contains a proof‑of‑concept demonstrating how a specific class of React Server Component vulnerabilities behaves inside a controlled, legal training environment. Manual root@kitploit: ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /\ ||...

CVE-2026-81835

A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetchinstructions of the file maliciousmcpserver.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The attack is possible to be carried out remotely...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP respons...

DEBIAN-CVE-2026-77341

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes trailer header names and values directly to the socket without validating them, allowing CRLF sequences in a trailer field to inject additional headers or split the HTTP respons...

CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Schwachstelle in CMSimpleXH Übersicht Eine Cross-Site Scripting XSS Schwachstelle wurde in CMSimpleXH Version 1.7.6 identifiziert. Diese Schwachstelle erlaubt autorisierten Benutzern, SVG-Dateien mit schädlichem JavaScript-Code hochzuladen. Das Problem...

CVE-2026-75417

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

CVE-2026-67560

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedomete...

CVE-2026-54330

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

cve-2020-7247

cve-2020-7247 एक्सप्लॉइट शीर्षक: OpenSMTPD 6.6.2 - रिमोट कोड निष्पादन। नई तिथि: 2020-01-29। एक्सप्लॉइट लेखक: 1F98D। मूल लेखक: Qualys Security Advisory। विक्रेता होमपेज: https://www.opensmtpd.org/। सॉफ्टवेयर लिंक: https://github.com/OpenSMTPD/OpenSMTPD/releases/tag/6.6.1p1। संस्करण: OpenSMTPD 6.6....

SC3010-Computer-Security

SC3010-Computer-Security — Nachstellung des Angriffs CVE-2017-5638 Dieses Repository ist Teil des SC3010 Computer Security-Kursprojekts. Es stellt CVE-2017-5638 nach, eine kritische Remote-Code-Ausführungssicherheitslücke in Apache Struts 2 Versionen 2.3.5–2.3.31 und 2.5–2.5.10, die...

TPASLog4ShellPoC

TPAS Log4Shell PoC Dieses Repository enthält einen Proof of Concept PoC für die Log4Shell-Schwachstelle CVE-2021-44228, der im Rahmen der Lehrveranstaltung TPAS des Masterstudiengangs Informationssicherheit an der FCUP entwickelt wurde. Es umfasst: Ein React SPA Frontend, das eine generische...

CVE-2025-4396

CVE-2025-4396 — Injeção SQL no Relevanssi Cega Baseada em Tempo Aviso: Este repositório é destinado exclusivamente para testes de penetração autorizados, pesquisa em segurança e fins educacionais. O acesso não autorizado a sistemas de computadores é ilegal e antiético. Visão Geral Um exploit de...