deny-af-alg-bpf

deny-af-alg-bpf Description BPF LSM program that blocks AFALG Linux kernel crypto API socket creation and logs all attempts via a ring buffer to userspace. What it does Attaches to the lsm/socketcreate hook Denies any socketAFALG, ... call with -EPERM Emits structured events pid, comm to a BPF ri...

CVE-2024-3400

CVE-2024-3400 Description A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code...

Torito-R2S

Torito React2Shell Scanner & Exploit Tool CVE-2025-55182 / 66478 Detection-first scanner for Next.js RSC targets with optional PoC confirm and exploit/shell modes. Use only on systems you are authorized to test. Requirements Python 3.9+ pip install -r requirements.txt Subfinder binary in PATH for...

CVE-2026-86745

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 the code was never included in a tagged release, SettingsController::downloadLocationScopingReport streams the FMCS location-scoping mismatch report GET /admin/settings/location-scoping-report.csv through...

CVE-2026-86742

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::postAssetAcceptanceReport builds the CSV by hand stripping commas and joining rows manually and, unlike the six sibling exports in the same controller, never...

CVE-2026-64857

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2025-71418

PocketMine-MP versions before 5.25.2 fail to limit the explode function in packet parsing, allowing malicious clients to waste server resources. Attackers can send crafted packets with excessive delimiters to consume CPU and memory through sign editing, JWT parsing, and command parsing endpoints...

gzip: gzip: Information disclosure via global buffer overflow in LZH decompression

A flaw was found in GNU gzip. This global buffer overflow vulnerability in the LZH decompression logic is caused by improper reuse of shared global state between different decompression formats. An attacker can exploit this by providing a specially crafted LZW file followed by a specially crafted...

CVE-2025-24893

Infos This PoC first tests for the SSTI and if it works. It will go in loop and allows you to run commands remotly. The exec and shell command do the same currently. Usage Connecting root@kitploit: python3 poc.py Example With debug set to False default root@kitploit: python3 poc.py...

solarview-ics-vulnerability-analysis

SolarView ICS Vulnerability Analysis A cyber-physical threat analysis of the SolarView Compact / Mirai botnet incident, in which attackers exploited CVE-2022-29303 to compromise roughly 800 solar monitoring appliances at Japanese photovoltaic facilities. Course project for ECE 362 — Cyber-Physica...

CVE-2026-36356

CVE-2026-36356: MeiG Smart FORGESLT711 GoAhead — Unauthenticated OS Command Injection /action/SetRemoteAccessCfg CVE : CVE-2026-36356 CWE : CWE-78, CWE-306 Discoverer : Daniil Gordeev Disclosed : 2026-05-03 Summary The GoAhead web server bundled with MeiG Smart FORGESLT711 4G LTE CPE devices...

droidground v1.0.15

DroidGround Website | Demo In traditional CTF challenges , it's common to hide flags in files on a system, requiring attackers to exploit vulnerabilities to retrieve them. However, in the Android world, this approach doesn't work well. APK files are easily downloadable and reversible, so placing ...

CVE-2026-67434

A flaw was found in PHPCodeSniffer. This command injection vulnerability allows an attacker to execute arbitrary shell commands. This occurs when PHPCodeSniffer processes untrusted files with specially crafted filenames containing shell metacharacters, specifically when generating Gitblame,...

CVE-2026-39987-Lab

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab Local-only Docker lab for reproducing and understanding CVE-2026-39987 in marimo. This project compares a vulnerable marimo service with a patched marimo service side-by-side, then demonstrates the difference using a least-harm proof...

CVE-2026-43284-CVE-2026-43500-scan

DirtyFrag Scanner & Patcher Internal Network Tool for CVE-2026-43284 & CVE-2026-43500 Automated Linux LPE Audit & Mitigation via SSH Disclaimer : This tool is specifically designed for legitimate internal security audits. Using it without authorization against systems that are not yours is a...

chpwd

DEPRECATED This is an old version of a CLI password vault. The development has been shifted to vlt: https://codeberg.org/artich0ke/vlt GitHub mirror: https://github.com/b0lbas/vlt. You can still download the utility / use it as a personal password storage, however, neither is recommended. chpwd A...

WhatsRCE

WhatsRCE This is a Automated Generate Payload for CVE-2019-11932 WhatsApp Remote Code Execution 1. Auto install GCC no harm command, you can see this is open-source 2. Saving to .GIF file How To Use ? root@kitploit: sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRC...

msdt-follina

MS-MSDT "Follina" Attack Vector John Hammond | May 30, 2022 Create a "Follina" MS-MSDT attack with a malicious Microsoft Word document and stage a payload with an HTTP server. Usage root@kitploit: usage: follina.py -h --command COMMAND --output OUTPUT --interface INTERFACE --port PORT options: -h...

CVE-2024-8353

This post is a research article published by EQSTLab. Thanks tocuokon, who discovered this vulnerability. Introduction Further Analysis CVE-2024-5932 EQST Insight R&TPDF file. https://github.com/user-attachments/assets/085c2f81-2894-4bb7-a3f5-62406dcb1021 CVE-2024-8353 ★ CVE-2024-8353 Arbitrary...

CVE-2024-2432-PaloAlto-GlobalProtect-EoP

CVE-2024-2432 Palo Alto GlobalProtect EoP On Windows system, it was found that GlobalProtect App version 6.1.1-5 and 6.2.0-89 was vulnerable to arbitrary file delete with elevated privileges by symbolic link attack lead to local privilege escalation on local machine. It was observed that when a...