65522 matches found
morty
Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...
CVE-2025-44148
CVE-2025-44148 - Reflected Cross-Site Scripting Reflected XSS Reflected Cross-Site Scripting XSS in MailEnable Vendor: MailEnable Pty. Ltd. Affected Versions: 10 Description A reflected cross-site scripting XSS vulnerability exists in MailEnable Webmail due to improper user input sanitization in...
keypair
keypair Generate a RSA PEM key pair from pure JS Usage root@kitploit: var keypair = require'keypair'; var pair = keypair; console.logpair; outputs root@kitploit: $ node example.js public: '-----BEGIN RSA PUBLIC...
haklistgen
haklistgen Turns any junk text into a usable wordlist for brute-forcing. Installation root@kitploit: go install github.com/hakluke/haklistgen@latest Usage Examples Scrape all words out of an HTTP response to build a directory bruteforce wordlist: root@kitploit: curl https://wikipedia.org |...
CVE-2019-10685
CVE-2019-10685 The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the "TextField" parameter. Exploit-DB publication at https://www.exploit-db.com/exploits/46804 PacketStorm publication at...
JSshell
JSshell - version 3.1 JSshell - a JavaScript reverse shell. This is used for executing JS code remotely, exploiting blind XSS, ... Requirements: Any OS + Python 2 or Python 3 New in JSshell version 3.1 Updated in the new version of JShell 3.1: New JSshell command: snippet - allows to write a...
seeker
Available in Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your location like many popular location based websites. Read more on thewhiteh4t's Blog .Seeker Hosts a fake website which asks for Location Permission and if...
xssless
xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...
cve-2022-42889-intercept
cve-2022-42889-intercept For versions below Java 11, special attention is required, as higher versions have already removed the Javascript interpreter. This solution targets Java 8. Intercept illegal parameters via JVM startup parameters and jps pid. quick start root@kitploit:...
cve-2019-11707
SpiderMonkey - CVE-2019-11707 Bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820 Screenshots Files exploit.js - Actual exploit, prepended by saelo's util.js & Int64.js. stager.js - Used for creating constants, prepended by saelo's util.js & Int64.js...
CVE-2021-40444_EXP_JS
This repository does not have a README...
urlgrab
Welcome to urlgrab 👋 A golang utility to spider through a website searching for additional links with support for JavaScript rendering. Install root@kitploit: go get -u github.com/iamstoxe/urlgrab Features Customizable Parallelism Ability to Render JavaScript including Single Page Applications su...
CVE-2026-6082
Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...
CVE-2026-6086
Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...
CVE-2026-6087
Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...
CVE-2026-6084
Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...
CVE-2023-43770-PoC
CVE-2023-43770-PoC PoC for Stored XSS CVE-2023-43770 Vulnerability Description Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior. Attack Chain Crafted...
webrtc-ips
STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...
CVE-2019-16172
CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...