phpMussel

What is phpMussel? An ideal solution for shared hosting environments, where it's often not possible to utilise or install conventional anti-virus protection solutions, phpMussel is a PHP script designed to detect trojans, viruses, malware and other threats within files uploaded to your system...

password-generator

Password Generator For BruteForce or Md5 Crack/Comparison root@kitploit: $ php password-generator --info="victim name,victim surname , victim age , victim email" --info Get all information from victim. --path The area where the file will be saved optional. --md5 The passwords created with this...

ExWA

ExWa WhatsApp for CLI with API ExWa is a simple tool written in PHP, which functions to use a CLI version of WhatsApp application with help of API from rapiwha.com Installation : $ git clone https://github.com/dalpan/ExWa $ cd ExWa $ php exwa.php Usage : Register first at https://rapiwha.com/ and...

XPL-SEARCH

XPL SEARCH root@kitploit: Search exploits/vulnerabilities in multiple databases online! XPL SEARCH is a multiplatform toolWindows and Linux, which was developed in PHP with the aim of helping the hacker community to find exploits or 'vulnerabilities', using online databases, below is the list of...

PHP-Shell-Detector

Web Shell Detector Web Shell Detector – is a php script that helps you find and identify php/cgiperl/asp/aspx shells. Web Shell Detector has a “web shells” signature database that helps to identify “web shell” up to 99%. By using the latest javascript and css technologies, web shell detector has ...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

CVE-2021-43936

CVE-2021-43936 CVE-2021-43936 is a critical vulnerability CVSS3 10.0 leading to Remote Code Execution RCE in WebHMI Firmware. This vulnerability works on versions 4.0 and the newest ones. Tested only on 4.0.7475. Vulnerability is used by script in the following steps: 1. Logs into the application...

HTMLawed

HTMLawed 是…… ……一个单文件、45 kb 的 PHP 脚本，从网页管理员的视角来看，它使输入文本更安全、符合 HTML 标准，并且总体上适合用作 HTML、XHTML 或 XML 文档的正文。作为 HTMLTidy 的简单替代品，htmLawed 过滤器、处理器、净化器、消毒器、美化器等具有高度可定制性。 它确保 HTML 标签平衡且正确嵌套，中和可能被用于跨站脚本（XSS）攻击的代码，限制允许的 HTML 元素、属性或 URL 协议，整理代码等。 因此，在净化场景中，它可以用作 HTMLtidy 的替代方案。 该仓库是…… ……一个衍生版本，紧密跟踪原始项目 链接...

DDoS-PHP-Script

DDoS PHP Script Script to perform a DDoS UDP flood by PHP Usage From web server visit the page: http://127.0.0.1/ddos.php?pass=apple&host=TARGET&port=PORT&time=SECONDS&packet=NUMBER&bytes=NUMBER From terminal: php ./ddos.php host=TARGET port=PORT time=SECONDS packet=NUMBER bytes=NUMBER Parameters...

drupalgeddon-2

Drupalgeddon-2 Drupal v7.x + v8.x 漏洞检测工具 使用方法 : root@kitploit: php drupalgeddon.php Target http://example.com :...

CVE-2017-5638-Apache-Struts2

CVE-2017-5638 Apache Struts2 CVE-2017-5638 的 PoC 利用 PHP 代码示例 用法 php exploit.php "http://127.0.0.1:8080/example/index.action" "command" 使用风险自负...

CVE-2026-38329

Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...

CVE-2026-38329

Bludit CMS is affected pre-3.18.4. The API Plugin's POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails authorization checks and lacks file extension validation, enabling an attacker with a valid API token to upload a PHP script and execute arbitrary code on the server (Remote Code ...

PT-2026-49297

Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...

CVE-2026-38329

Bludit CMS before version 3.18.4 allows Remote Code Execution RCE via the API Plugin. The POST /api/files/key endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and...

CVE-2026-48687

CVE-2026-48687 affects FastNetMon Community Edition up to 1.2.9, specifically the Juniper router integration plugin. The OS command injection stems from the PHP file src/juniper_plugin/fastnetmon_juniper.php (log function) which builds shell commands by concatenating unsanitized user data from ar...

CVE-2026-9355

CVE-2026-9355 affects SourceCodester Hospitals Patient Records Management System 1.0. The vulnerability is a SQL injection in the function handling /classes/Master.php?f=save_patient_history, triggered by manipulation of the ID argument. This allows remote exploitation and an exploit has been pub...

CVE-2026-35010

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patientJF.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into a JavaScript variable assignment. Attackers...

EUVD-2018-21854

Zenar Content Management System contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating form parameters in POST requests. Attackers can inject script tags through the currentpage parameter sent to the ajax.php endpoint, which...

PT-2026-41391

Name of the Vulnerable Software and Affected Versions FrankenPHP versions 1.11.2 through 1.12.2 Description An unsafe Unicode handling flaw exists in the CGI path splitting process. The splitPos function in cgi.go incorrectly uses the golang.org/x/text/search library with search.IgnoreCase when...