CVE-2026-11113-SMTP-Header-Injection-in-Contact-Form

CVE-2026-11113 – Inyección de Cabeceras SMTP en el Formulario de Contacto Código del Programa Python root@kitploit: contactformserver.py - Mails feedback without sanitizing headers from flask import Flask, request import smtplib app = Flaskname @app.route'/contact', methods='POST' def contact:...

CVE-2022-42045

CVE-2022-42045 Summary We discovered an Arbitrary code injection in Zemana amsdk.sys kernel-mode driver, a part of Zemana Antimalware SDK. The vulnerability allows to inject an arbitrary code into the one of the driver code sections and then to execute it with kernel-mode privileges local...

AtlasLdr

Atlas es un cargador reflectivo x64 que tiene las siguientes características: Características Obtención de DLL y PE desde un servidor remoto Mapeo manual en un proceso remoto Borrado de los bytes mágicos de la cabecera DOS y de NTHeader Código independiente de posición Uso de syscalls indirectas...

CVE-2025-66516-Writeup-POC

CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...

EUVD-2026-86537

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-93899

The Better Messages plugin for WordPress (all versions up to and including 3.0.4 ) is vulnerable to a generic SQL Injection via the 'group_id' Message Meta Parameter. The root cause is insufficient escaping of the user-supplied parameter and a lack of sufficient preparation on the existing SQL qu...

CVE-2026-93899 Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'groupid' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2023-51385_test

Verify CVE-2023-51385 First, add the following content to /.ssh/config root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement root@kitploit: url = ssh://echo helloworld cve.txtfoo.example.com/bar Afte...

CVE-2026-24061-PoC-Exploit

🚀 CVE-2026-24061 - GNU inetutils-telnetd Authentication Bypass Exploit GNU inetutils-telnetd Edition - CRLF Injection to Authentication Bypass & Instant Root Shell 📌 Overview This exploit leverages CVE-2026-24061 , a critical remote authentication bypass vulnerability in GNU inetutils-telnetd. By...

vibegate

A security checkpoint for AI coding tools. It looks at every file an AI assistant writes, and stops the dangerous ones before they hit disk. What problem does this solve? AI coding assistants Claude Code, Codex, … write code fast — including code that handles things like passwords, emails, API...

Cybersec

Offensive CyberSec Cheat Sheet A highly dynamic, single-file HTML cheat sheet designed for Red Teamers, Pentesters, and CTF players. Tired of typing the same Reverse Shell payloads and constantly replacing your local IP and port? This tool eliminates the "Typo Fatigue" and cognitive load during...

CVE-2016-10204_Webshell

CVE-2016-10204Webshell A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint, leading to upload of a php webshell. Currently, the webshell variable is set for a MySQL payload. This can be replaced with whatever backend you need to target. More information...

CVE-2026-67598

CVE-2026-67598 Emlog Pro — Validación de certificados TLS deshabilitada en el asistente de IA MITM adyacente a la red → robo de clave de API del proveedor de LLM e inyección de respuestas de IA...

Kernel_VADInjector

Driver DLL Injector Driver DLL Injector Descripción Driver DLL Injector es una herramienta potente que permite a los usuarios cargar los controladores de su elección utilizando su mapeador preferido. Aprovechando las capacidades de un cargador de controladores sin firmar, como KDmapper, este...

RemoteDLLInjector

Introduction This is a tools which can be used to dll injection： From the moment that RemoteDLLInjector executes will provide the full steps that performs in order to achieve DLL injection. If the DLL is successfully injected it will return back a meterpreter session with the privileges of the...

Log4J-Simulation-Tool

About The Project This is a specially crafted automated Vulnerability Scanner, Patch Management and Exploitation tool for CVE-2021-44228. This is a combination of Python, Java and Linux shell program which will make it easier for a Network Administrator, Endpoint Security Developers and...

CVE-2023-6654

CVE-2023-6654 PHPEMS Cookie deserialization vulnerability. Exploiting this vulnerability allows modifying SQL statements through deserialization, and through SQL injection, changing the password or permissions of any existing user. The default administrator account is peadmin. Fofa fingerprint...

Collabfiltrator

Collabfiltrator Exfiltrate Blind Remote Code Execution and SQL injection output over DNS via Burp Collaborator. Version: 4.0.1 Authors: Adam Logue Jared McLaren Frank Scarpella Ryan Griffin AI Authors: Claude 3.5 Sonnet ChatGPT 4o Requirements: Burp Suite Professional 2024.12.1 or Later Support:...

CVE-2024-2997

CVE-2024-2997 Scanner Overview CVE-2024-2997 Scanner is an advanced vulnerability scanner designed to detect the command injection vulnerability in web applications. This tool helps security professionals identify potential security risks in their applications. Disclaimer This tool is for...

MAL-011

MAL-011: Log4J Misconfiguration Allows Malicious JavaScript in Red Hat AMQ The Log4J component of the Redhat A-MQ application is misconfigured to allow the execution of arbitrary “Script” attributes in the Log4J config. If an attacker finds a way to modify the Log4J config used by A-MQ e.g. via...