CVE-2023-33768

CVE-2023-33768 Description Incorrect signature verification of the firmware during the Device Firmware Update process of Belkin Wemo Smart Plug WSP080 v1.2 allows attackers to cause a Denial of Service DoS via a crafted firmware file. Additional Information When updating the firmware of the Wemo...

strutt-cve-2014-0114

CVE-2014-0114 - Vulnerability in Struts 1 Parameters in a POST or GET request are handled as properties to be set with the form as a starting point. Parameters can be a path to a nested object. Apache Struts 1.x can be manipulated to call getClass on Form Beans. For example, one can directly...

ProHunter

📋 Overview This project is a core module of the ProHunter system, primarily designed to perform malicious judgment on threat graphs sampled from the PPG module. The main idea of this methods is that uses inexact graph vector matching to calculate vector similarity between threat graphs and attack...

dvwassl

SSL-enabled Damn Vulnerable Web App Run an SSL-enabled Damn Vulnerable Web App. Why? You might want to test web attack detections over SSL. Build the image root@kitploit: docker build -t dvwassl:latest . Run the container root@kitploit: docker run -d -p 443:443 dvwassl:latest Custom SSL certifica...

blanket

blanket Blanket is a sandbox escape targeting iOS 11.2.6, although the main vulnerability was only patched in iOS 11.4.1. It exploits a Mach port replacement vulnerability in launchd CVE-2018-4280, as well as several smaller vulnerabilities in other services, to execute code inside the ReportCras...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

CVE-2020-3153

CVE-2020-3153 Cisco AnyConnect 4.8.02042 privilege escalation through path traversal Description The auto-update feature of Cisco AnyConnect is affected by a path traversal vulnerability. An attacker can exploit this vulnerability to gain system level privileges. For more details, please refer to...

agentic-threat-hunting-framework

Agentic Threat Hunting Framework ATHF Quick Start • Installation • Documentation • Examples Give your threat hunting program memory and agency. The Agentic Threat Hunting Framework ATHF is the memory and automation layer for your threat hunting program. It gives your hunts structure, persistence,...

HosTaGe

HosTaGe - Honeypot-To-Go Copyright C 2013-2021, Aalborg University Denmark and Technische Universität Darmstadt Germany HosTaGe is a lightweight, low-interaction, portable, and generic honeypot for mobile devices that aims on the detection of malicious, wireless network environments. As most...

Max

Maximizing BloodHound with a simple suite of tools Description New Release: dpat - The BloodHound Domain Password Audit Tool DPAT A simple suite of tools: get-info - Pull lists of information from the Neo4j database mark-owned - Mark a list of objects as Owned mark-hvt - Mark a list of objects...

CVE-2022-1077

CVE-2022-1077 Description A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated remotely an...

CVE-2026-78159 The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

EUVD-2026-76833

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

CVE-2026-78159

The Events Calendar WordPress plugin (versions ≤ 6.17.3 ) is vulnerable to unauthenticated remote code execution via the Element_Classes::parse_array() function. Insufficient validation of the widget classes map allows a plain-array payload to bypass the is_safe_widget_instance() object check and...

ad-autopwn

AD AutoPwn Zero-Auth to Domain Admin — Automated Active Directory Attack Chain A fully automated penetration testing tool that chains 25+ attack techniques to compromise Active Directory environments. Designed for authorized security assessments. root@kitploit: /\ | \ /\ | | | \ / | | | / \ || | ...

auditd-attack

auditd-attack A Linux Auditd rule set mapped to MITRE's Attack Framework Disclaimer Please ensure you test these rules prior to pushing them into production. This rule set is NOT meant to have all of its rules enabled all at once although that'd be ideal it is setup to serve as guidance toward...

CVE-2022-42889

CVE-2022-42889 Python script for CVE-2022-42889 To test this locally follow the docker POC: https://github.com/karthikuj/cve-2022-42889-text4shell-docker For a PHP version of this: https://github.com/ClickCyber/cve-2022-42889 If youre running this and exploiting it locally, the IP you need to use...

CVE-2025-59287-PoC

CVE-2025-59287 / CVE-2023-35317 PoC Inside CVE-2025-59287: SoapFormatter RCE in WSUS: https://shellcode.blog/wsus-cve-2025-59287-investigation/ This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intende...

stegbrute

stegbrute stegbrute is a fast steganography brute force tool written in Rust Dependencies Stegbrute cannot run without steghide!, to install steghide run : root@kitploit: apt-get install -y steghide if you are not in a debian distribution you can download it from steghide website Installation...

CVE-2023-30092

CVE-2023-30092 All Details about CVE-2023-30092 Software: Online Pizza Ordering System 1.0 Software Link: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html Vulnerability Type: SQL Injection Affected Component: QTY Parameter Impact Denial of Service:...