CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – PDF JavaScript Injection via Embedded Script Program Code Python generating malicious PDF root@kitploit: generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f: f.writepdf...

mqxss

mqxss v0.2 mqxss acts as a client to communicate with hooked browsers over MQTT The benefit to using this over beef or xsshunter is that besides hosting the js payload there is no infra setup, you can use a public broker however currently uses obfuscation, encryption is in the works. Hooked...

CVE-2022-28672

CVE-2022-28672 Discord Server Este error fue un Use after Free causado por un manejo inadecuado de las referencias de memoria de objetos de JavaScript. Blog Foxit PDF Reader - UaF - RCE - JIT Spraying Advisory CVE-2022-28672 Demo...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Reflected Cross-Site Scripting XSS Table of Contents Overview Vulnerability Details Affected Product Technical Analysis Proof of Concept Steps to Reproduce Impact Mitigation & Remediation References Disclaimer Overview A Reflected Cross-Site Scripting XS...

xssor2

XSS'OR XSS'OR - Hackea con JavaScript. EN LÍNEA Puedes probarlo: https://xssor.io and http://xssor.io/ Contiene tres módulos principales: Encode/Decode, Codz, Probe. INSTALACIÓN Python 3 con Django 3.0. o Python 2 con Django 1.11. git clone https://github.com/evilcos/xssor2 o descárgalo...

AMSIext

AMSIext AMSIext is a Firefox and Chrome plugin that allows you to send any data stream from the browser to AMSI. AMSI is the way to communicate RAM memory with Windows Defender or any other endpoint security system. This means that while browsing the web, AMSIext will alert you to malicious...

FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp

Este método de rastreo del honeypot apunta a los miembros del equipo rojo que usan hotspots móviles. El honeypot obtiene directamente el número de teléfono del atacante para rastrearlo. Atrapa a uno con precisión. ¡Cuidado, miembros del equipo rojo! Primero, al abrir el sitio web, monitorea si se...

avscript

Avast Antivirus JavaScript Interpreter NOTE: On 03/11/2020 Avast announced they had decided to disable this interpreter globally! The main Avast antivirus process is called AvastSvc.exe, which runs as SYSTEM. That service loads the low level antivirus engine, and analyzes untrusted data received...

wordlistgen

wordlistgen Generates target specific word lists by searching for endpoints in javascript and appends parameters for Fuzzing with other tools Version 1.0 Install $ go get -u github.com/ethicalhackingplayground/wordlistgen $ go get github.com/003random/getJS Generate wordlist $ echo...

CVE-2026-34621

CVE-2026-34621 : Adobe Acrobat 2026 Prototype Pollution & JS Injection Chain — Research PoC Overview This repository contains research material and proof-of-concept code developed during the analysis of the 2026 Adobe Acrobat Reader in-the-wild exploit chain involving: Prototype Pollution Interna...

CVE-2025-54100

CVE-2025-54100 Powershell's curl uses Invoke-WebRequest underneath. root@kitploit: PS C:\Users\melih curl cmdlet Invoke-WebRequest at command pipeline position 1 Supply values for the following parameters: Uri:...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

CVE-2025-14814

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbox shortcode in all versions up to, and including, 12.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2021-26832

CVE-2021-26832 Descripción sugerida Cross Site Scripting XSS en el formulario de la página 'Restablecer contraseña' de Priority Enterprise Management System v8.00 permite a los atacantes ejecutar javascript en nombre de la víctima mediante el envío de una URL maliciosa o dirigiendo a la víctima a...

com.heytap.browser

Vulnerability Report Overview: A vulnerability has been discovered in the com.heytap.browser application on the Android platform. The vulnerability allows an attacker to execute arbitrary JavsScript code within the context of the application without any permissions. Application Details: Vendor: -...

jsprime

Authors Nishant Das Patnaik nishant.dp@ Sarathi Sabyasachi Sahoo sarathisahoo@ Introduction Today, more and more developers are switching to JavaScript as their first choice of language. The reason is simple JavaScript has now been started to be accepted as the mainstream programming for...

InfoLeak-Scanner

InfoLeak-Scanner Docker First run docker run --rm -p 8000:80 siwecos/infoleak-scanner. Open your browser and use the scanner: http://localhost/?url= Install Get php5, curl and a webserver: root@kitploit: sudo apt-get install apache2 php5 php5-curl Copy application into webserver: root@kitploit: c...

cwe-sdk-javascript

cwe-sdk A Common Weakness Enumeration CWE Node.js SDK compliant with MITRE / CAPEC...

HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling. Description The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion...