389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

389-ds-base: 389-ds-base: Command injection via unescaped LDAP DN in Cockpit 389 Console LDAP editor

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

Critical: Red Hat Security Advisory: redhat-ds:11 security, bug fix, and enhancement update

An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.7 E4S for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

cve-2024-8069-exp-Citrix-Virtual-Apps-XEN

CVE-2024-8068 and CVE-2024-8069 Citrix Virtual Apps and Desktops XEN Unauthenticated Remote Code Execution Vulnerability Check out our blog post for detailed technical information. https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 Exploit Demonstration root@kitploit:...

CVE-2024-22275

CVE-2024-22275: Partial File Read in VMware vCenter Server The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the vCenter appliance shell may exploit this issue to partially read arbitrary files containing sensitive data. Vendor...

CVE-2021-42559

CVE-2021-42559: Command Injection via Configurations in MITRE Caldera Caldera versions =2.8.1 contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the Rest API, an authenticated user can insert arbitrary commands that...

MGASA-2026-0382 Updated tor packages fix security vulnerabilities

An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type CVE-2026-77642. A NULL write after free when sending a CONFLUXSWITCH cell fails, resulting in a crash CVE-2026-77641. An infinite loop when decompressing a truncated zlib/gzip stream with...

Updated tor packages fix security vulnerabilities

An out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type CVE-2026-77642. A NULL write after free when sending a CONFLUXSWITCH cell fails, resulting in a crash CVE-2026-77641. An infinite loop when decompressing a truncated zlib/gzip stream with...

CVE-2020-8248

CVE-2020-8248: Privilege Escalation via Zip Wildcard Exploit in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function “doupload” that unsafely calls a zip command with wildcards “”. By writing files with specifically crafted names, in a user- controlled folder...

CVE-2020-8250

CVE-2020-8250: Privilege Escalation via Command Injection in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function “doupload” that unsafely passes the “HOME” environmental variable to “system”. By altering the “HOME” variable to contain special shell characters Ex: “” or...

semgrep-rules

Trail of Bits public Semgrep rules This repository contains Semgrep rules developed by Trail of Bits and made available to the public. They are part of our ongoing development efforts and are used in our security audits, vulnerability reseach, and internal projects. They will evolve over time as ...

CVE-2020-12641

CVE-2020-12641: Command Injection via “imconvertpath” Parameter in Roundcube Webmail A Command Injection vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. Because the "imconvertpath" does not perform sanitization/input filtering, an attacker with access to the Roundcube...

mvt v2026.9.7

Mobile Verification Toolkit !IMPORTANT We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757 Mobile Verification Toolkit MVT is a collection of utilitie...

CVE-2024-31969

📌 CVE-2024-31969 CVE-2024-31969 is a local privilege escalation vulnerability in sudo when using the sudoedit command. This vulnerability was introduced in sudo 1.9.0 due to the way sudoedit validates user environment variables and file ownership improperly. 📖 Description A flaw introduced in sud...

CVE-2026-13714

root@kitploit: Realtyna WPL 5.3.0 - Unauthenticated RCE Exploit Description This exploit targets a critical vulnerability in Realtyna Organic IDX + WPL Real Estate plugin versions prior to 5.3.0. The plugin uses hardcoded credentials and allows unauthenticated file upload leading to Remote Code...

wp2shell

wp2shell - PoC de RCE en WordPress CVE-2026-63030 + CVE-2026-60137 Ejecución Remota de Código no autenticada en el núcleo de WordPress por: JohenLastGen 📌 Resumen Esta herramienta encadena dos vulnerabilidades críticas de WordPress para lograr RCE no autenticado : Vulnerabilidad| CVE| Descripción...

rats-re

Rats! source reconstruction with local LLMs This repository is a work-in-progress reconstruction of the source code for RATS.EXE, the original Windows version of Rats! 1994 by Sean O'Connor. It builds a Win32 executable with Microsoft Visual C++ 4.1 under wibo and can be tested in DREAMM. The...

CVE-2024-38821-POC

CVE-2024-38821: Proof of Concept PoC: Authentication Bypass in Spring Framework This is a proof of concept for the CVE-2024-38821 vulnerability Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 root@kitploit: cd vuln docker build -t cve-2024-38821-poc...

CVE-2021-3560-Polkit-Privilege-Escalation

CVE-2021-3560-Polkit-Privilege-Escalation by Mark, Qingchen Yu To build the container with root@kitploit: docker build -t . To run the container root@kitploit: docker run -it 1. start with start.sh 2. Measura Execution Time: Note the 'real' time and calculate half of it. root@kitploit: time...

picohaxx

souce próximamente™ picohaxx Exploit de kernel de código abierto para dispositivos Pico 4 basado en cve-2023-33107 root@kitploit: Usage: picohaxx options -- GENERAL OPTIONS: -help Show this help menu -v Print build timestamp and exit -unroot unroot adbd -nobash once adb root is unlocked, the...