EUVD-2026-67196

Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spri...

CVE-2026-59288

The GraphiQL page bundled with Spring for GraphQL sends requests to the application's GraphQL endpoints. An attacker can share a malicious URL that, when visited by a victim, causes the victim's browser to leak confidential information to the attacker's website. This is an information exposure is...

EUVD-2026-67177

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

CVE-2026-76218

A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the Repo.init function, an attacker can point to a directory containing malicious Git hooks. When Git operations are performed on...

CVE-2018-6574

CVE-2018-6574 Passos para reproduzir: 1. Crie um arquivo .c contendo o comando malicioso revshell: root@kitploit: include include static void malicious attributeconstructor; void malicious system""; 2. Compile-o usando GCC. Você deve compilá-lo exatamente na mesma arquitetura e SO do alvo por...

pollyscan

Pollyscan-CVE-2024-38526-Scanner di Vulnerabilità È uno strumento di sicurezza leggero progettato per rilevare CVE-2024-38526, l'attacco alla supply chain di Polyfill.io. Esegue la scansione delle dipendenze web per individuare iniezioni dannose e rilevamento automatico. Installazione git clone...

CVE-2026-34674

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

uaf-2023-28205

CVE-2023-28205: Vulnerabilità Use-After-Free in Apple WebKit Questa vulnerabilità può essere sfruttata tramite contenuti web maliziosamente predisposti, consentendo agli aggressori di eseguire codice arbitrario. Descrizione Il codice attiva una vulnerabilità use-after-free UAF ritardando l'aggiun...

CVE-2024-52510

POC di bypass di X-E2EE-SIGNATURE di Nextcloud Riepilogo Durante il normale funzionamento del protocollo E2EEv2 di Nextcloud, i client firmano crittograficamente i metadati delle cartelle prima di caricarli sul server. Questo garantisce che i metadati non siano stati manomessi quando vengono...

tanscript-exploit-check

Attacco alla supply chain Mini Shai-Hulud — Controllore IOC root@kitploit: curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash Oppure clona ed esegui localmente: root@kitploit: git clone...

threatDemos

🚨 Repository di Dimostrazioni di Minacce alla Sicurezza Android Una raccolta completa di prove di concetto di vulnerabilità di sicurezza Android e vettori di attacco Questo repository funge da risorsa educativa che mostra minacce alla sicurezza Android reali e le loro corrispondenti strategie di...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Versione immagine: 267r Livello di patch: 639 Vulnerabilità: DOM Based XSS Description Il software di gestione CAE Learning Space Enterprise è vulnerabile a un attacco DOM Based XSS. Un attacco DOM Based XSS...

CVE-2026-34674 Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-34674

Adobe Substance 3D Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow (CWE-122) that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction , specifically that a victim must open a malicious file. Adobe rated th...

EUVD-2026-67082

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

xzwhy

xzwhy root@kitploit: / / / / \ / /\ Questo progetto è una Proof of Concept POC compatibile con Kubernetes per CVE-2024-3094, che interessa XZ Utils. Vedi questo articolo per un'ottima analisi dell'origine e del funzionamento dell'exploit. AVVERTENZA ⚠⚠⚠ L'esecuzione di uno qualsiasi dei comandi...

CVE-2021-33699_Task_Hijacking

CVE-2021-33699TaskHijacking Cos'è? Un'app malevola e un'app vittima per esercitarsi sulla vulnerabilità CVE-2021-33699Task Hijacking. Riferimento https://naro-security.tistory.com/55...

CVE-2026-81700 openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

opensslencrypt versions before 1.4.9 contain a signature verification vulnerability in gpgrunner.verifydetached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing key...

CVE-2024-37051

CVE-2024-37051 Analyse Überblick CVE-2024-37051 ist eine Schwachstelle, die in JetBrains' IntelliJ-basierten IDEs gefunden wurde und das GitHub-Plugin betrifft. Sie ermöglicht die unbefugte Offenlegung von GitHub-Zugriffstokens, wenn ein bösartiger Pull Request PR geladen wird. Technische Details...