OpenSSL-CCS-Inject-Test

OpenSSL CCS Inject Test This script is designed for detection of vulnerable servers CVE-2014-0224. in a wide range of configurations. It attempts to negotiate using each affected protocol version SSLv3, TLSv1, TLSv1.1, and TLSv1.2 advertising a comprehensive set of ciphers. Changes: v0.1 - Update...

jvmxray

JVMXRay: Monitoreo de Seguridad en Aplicaciones Java Historia de Duke Documentación | Cambios desde Upstream | Blog del Proyecto JVMXRay monitorea aplicaciones Java en tiempo real mediante inyección de bytecode, detectando vulnerabilidades y actividad sospechosa sin cambios en el código. 19...

CVE-2026-87071

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

CVE-2026-87070

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

social-analyzer

Social Analyzer - API, CLI, and Web App for analyzing & finding a person's profile across +1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process. The detection modules utilize a rating mechanism...

CVE-2020-8840

CVE-2020-8840: FasterXML/jackson-databind Remote Code Execution Vulnerability 0x00 Introduction jackson-databind is a JSON processing library under the FasterXML project. 0x01 Vulnerability Overview On February 19, NVD released a security advisory disclosing a remote code execution vulnerability...

Hollow

Hollow hollow es un generador de cargadores de shellcode. Le proporcionas un binario de shellcode sin procesar y un perfil, y genera un cargador PE de Windows compilado con tu shellcode encriptado en su interior. Comenzando Los binarios están disponibles en la página de lanzamientos, o puedes...

skill-scanner

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. Combines YAML + YARA, , and to maximize detection coverage of probable threats while minimizing false positives...

CVE-2023-22496-PoC

CVE-2023-22496 — Netdata Agent OS Command Injection PoC Severity : Critical CVSS 9.8 Affected : Netdata Agent Fixed in : v1.37.0 Type : OS Command Injection CWE-78 Overview CVE-2023-22496 is an OS command injection vulnerability in Netdata's health alarm notification system. The registryhostname ...

CVE-2022-42889-PoC

CVE-2022-42889 a.k.a. Text4Shell RCE Proof of Concept Text4Shell is the popular name of a critical software vulnerability discovered in the Apache Commons Text library see CVE-2022-42889. This repo is meant to demonstrate a Remote Code Execution RCE that leverages this CVE. The vulnerable code is...

CVE-2025-45960

CVE-2025-45960 - tawk.to Live chat - 1.6.1 - Cross-Site Scripting XSS Vulnerability Confirmed on 1.6.1 older versions likely affected Description: Found that the web application stores and displays user-supplied input without proper input validation or encoding. This leading to a malicious code...

CVE-2017-6079-Blind-Command-Injection-In-Edgewater-Edgemarc-Devices-Exploit

Introduction This exploit was developed based on the technical description by depthsecurity root@kitploit: https://depthsecurity.com/blog/cve-2017-6079-blind-command-injection-in-edgewater-edgemarc-devices Description The HTTP web-management application on Edgewater Networks Edgemarc appliances h...

CVE-2020-36708

CVE-2020-36708 – WordPress Epsilon Framework Function Injection PoC Overview CVE-2020-36708 is a vulnerability in the Epsilon Framework for WordPress that allows unauthenticated attackers to invoke arbitrary PHP class methods via the AJAX action epsilonframeworkajaxaction. This issue is categoriz...

CVE-2020-8825

CVE-2020-8825 Publish: CVE-2020-8825 Vendor: root@kitploit: PHP VanillaForum Description: root@kitploit: The vulnerability exists due to insufficient sanitization of user-supplied data passed to "index.php?p=/dashboard/settings/branding" URL. A remote attacker can permanently inject and execute...

intentshield

IntentShield Don't filter what your AI says. Filter what it's about to do Pre-execution intent verification for AI agents. Why This Exists AI agents have tool access. They can execute shell commands, write files, browse URLs, send emails, and call APIs. Every one of those actions is a potential...

CVE-2022-31061

CVE-2022-31061 PoC for GLPI CVE-2022-31061 A Proof of Concept for GLPI = 9.3.0 and 10.0.2 - Unauthenticated SQL injection on login page Legal disclaimer : Use of this script for attacking à target without mutual consent is illegal. It's is the end user responsibility to obey all applicables laws...

phishery

phishery Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. Phishery also provides the ability easily to inject the URL into a .docx Word document. The power of phishery is best demonstrated by setting a Word document's template...

CVE-2022-1388_PoC

F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: root@kitploit: POST /mgmt/tm/util/bash HTTP/1.1 Host: :8443 Authorization: Basic YWRtaW46 Connection: keep-alive, X-F5-Auth-Token X-F5-Auth-Token: 0 "command": "run" , "utilCmdArgs": " -c 'id' " curl commandliner: root@kitploit: $ curl -i -s -k -X...

challack

Proof-of-concept code for CVE-2016-5696 This code currently allows reseting connections or injecting into sessions. The attack is implemented against both clients and servers. For detailed information, consult the original publication: Off-Path TCP Exploits: Global Rate Limit Considered Dangerous...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL Injection Environment Initialization root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Vulnerability Reproduction root@kitploit: 访问http://x.x.x.x:8000/demo POC:...