Lucene search
+L

202888 matches found

Kitploit
Kitploit
added 2026/09/15 7:01 p.m.5 views

CVE-2023-23752

CVE-2023-23752 This is a proof-of-concept code for the CVE-2023-23752 vulnerability. It allows an attacker to extract sensitive information such as usernames, passwords, and database names from a target application. Bulk scanner + get config + ip target from CVE-2023-23752 Screenshot Installation...

5.3CVSS7.1AI score0.99827EPSS
SaveExploits43
Kitploit
Kitploit
added 2026/09/15 3:33 p.m.8 views

CVE-2020-14179

CVE-2020-14179 Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint Priority: High Affects Version/s: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names a...

5.3CVSS6.8AI score0.76042EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/15 3:14 p.m.13 views

CVE-2024-23995

Beekeeper-Studio PoC A Proof-Of-Concept for CVE-2024-23995 vulnerability. 1.Vunerability Overview: Vulnerability Subject: RCE via XSS Vulnerability Version: = Beekeeper-Studio-4.1.13 Attack Type: Remote Code Execution Attack Vectors: To exploit the vulnerability, one must insert malicious scripts...

6.1CVSS6.1AI score0.00962EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/15 1:00 p.m.7 views

CVE-2020-0753-and-CVE-2020-0754

Writeup and POC for CVE-2020-0753, CVE-2020-0754 and six fixed Window DOS Vulnerabilities Exploit FileSystem race condition bug - analysis of CVE-2020-0753 and CVE-2020-0754 Windows Error Reporting service has fixed 2 Elevation of Privilege bugs in last Patch Tuesday, the two bugs are assigned wi...

7.8CVSS7AI score0.02313EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 11:21 a.m.41 views

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

5.8AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 10:20 a.m.19 views

CrossLinked

CrossLinked CrossLinked is a LinkedIn enumeration tool that uses search engine scraping to collect valid employee names from an organization. This technique provides accurate results without the use of API keys, credentials, or accessing LinkedIn directly! Table of Contents Install Prerequisites...

6.1AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/15 9:20 a.m.64 views

phishing_catcher

Phishing Catcher Catch possible phishing domains in near real time by looking for suspicious TLS certificate issuances reported to the Certificate Transparency Log CTL via the CertStream API. "Suspicious" issuances are those whose domain name scores beyond a certain threshold based on a...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/15 8:05 a.m.35 views

dcrawl

dcrawl dcrawl is a simple, but smart, multi-threaded web crawler for randomly gathering huge lists of unique domain names. How it works? dcrawl takes one site URL as input and detects all links in the site's body. Each found link is put into the queue. Successively, each queued link is crawled in...

5.5AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 6:36 a.m.10 views

http-vuln-cve2019-14322.nse

http-vuln-cve2019-14322.nse Nmap NSE script to detect CVE-2019-14322 of Pallets Werkzeug path traversal via SharedDataMiddleware mishandles drive names such as C: in Windows pathnames Description CVE-2019-14322 - A vulnerability was found in Pallets Werkzeug up to 0.15.4. It has been declared as...

7.5CVSS7AI score0.55803EPSS
SaveExploits7References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.49 views

Blinko <= 1.8.3 - User Information Leak

Blinko = 1.8.4 contains an information disclosure caused by a publicly accessible endpoint exposing user information including usernames, roles, and account creation dates, letting remote attackers access sensitive user data, exploit requires no special privileges. id: CVE-2026-23486 info: name:...

6.9CVSS5.7AI score0.00711EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.42 views

PraisonAI AgentOS - Information Disclosure

PraisonAI's AgentOS FastAPI application server exposes an unauthenticated GET /api/agents endpoint that lists every registered agent's name, role and the opening of its instructions system prompt. No authentication is enforced on the route, allowing a remote attacker to enumerate agent...

7.3CVSS7.5AI score0.28571EPSS
SaveExploits4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.31 views

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

10CVSS6.4AI score0.03315EPSS
SaveExploits1References3
Kitploit
Kitploit
added 2026/09/15 5:20 a.m.32 views

rustbuster

rustbuster 包括的なWebファズツール&コンテンツディスカバリーツール はじめに ブログ記事を参照: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool ダウンロード ビルド済みのバイナリはこちらからダウンロードできます。 インストール root@kitploit: installrustbuster echo "Installing latest version of Rustbuster" latestversion=curl -s...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 4:02 a.m.10 views

CVE-2025-69848-security-advisories

Reflected XSS in NetBox ProtectedError Handling CVE-2025-69848 Overview NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scripting XSS vulnerability exists in the ProtectedError exception handling logic. When a delete operation...

5.4CVSS6.1AI score0.00304EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 1:18 a.m.17 views

mwebfp

LNHG - Massive Web Fingerprinter mwebfp Introduction The "LowNoiseHG LNHG Massive Web Fingerprinter " "mwebfp " from now on was conceived in July 2013 after realizing the usefulness of webserver screenshots to pentesters, during an engagement with large external or internal IP address ranges, as ...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 12:45 a.m.11 views

CVE-2019-14322

CVE-2019-14322 针对 faisalfs10x 漏洞利用的修改:CVE-2019-14322 概念验证:路径名到受限目录的限制不当(“路径遍历”) https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/ https://nvd.nist.gov/vuln/detail/CVE-2019-14322 描述 在 Pallets Werkzeug 0.15.4 及之前版本中发现了一个漏洞,已被评为严重级别。该漏洞影响 Windows 组件的 SharedDataMiddleware...

7.5CVSS7.6AI score0.55803EPSS
SaveExploits7References2
EUVD
EUVD
added 2026/09/15 12:31 a.m.6 views

EUVD-2026-78209

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

8.8CVSS6.2AI score0.0042EPSS
SaveExploits0References6
NVD
NVD
added 2026/09/14 11:19 p.m.6 views

CVE-2026-91200

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

8.8CVSS0.0042EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/14 4:27 p.m.4 views

Gitea-template-sync-Path-Traversal-Privilege-Escalation-CVE-2026-38526-

Nexus — Local Privilege Escalation PoC Gitea template-sync path traversal via forged Git objects → root A proof-of-concept privilege-escalation exploit for the HackTheBox machine Nexus. A root-owned systemd service synchronizes Gitea template repositories to disk without sanitizing entry names,...

9.9CVSS6.1AI score0.03824EPSS
SaveExploits13
Kitploit
Kitploit
added 2026/09/14 2:52 p.m.54 views

domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

5.7AI score
SaveExploits0References1
Rows per page
Query Builder