CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

z80-sans

Z80 Sans What's your favourite disassembler? Mine's a font: https://github.com/user-attachments/assets/bb6ceb18-c2fd-40a9-be4f-202321a214d9 This font converts sequences of hexadecimal lowercase characters into disassembled Z80 instructions, by making extensive use of OpenType's Glyph Substitution...

Pre-render-data-spoofing-on-React-Router-framework-mode-CVE-2025-43865

Welcome to React Router! A modern, production-ready template for building full-stack React applications using React Router. Features 🚀 Server-side rendering ⚡️ Hot Module Replacement HMR 📦 Asset bundling and optimization 🔄 Data loading and mutations 🔒 TypeScript by default 🎉 TailwindCSS for stylin...

pe2pic

English || 简体中文 pe2pic Small visualizator for PE files Getting started Install the dependencies by: root@kitploit: pip install -r requirements.txt Usage root@kitploit: usage: pe2pic.py -h --infile INFILE --outfile OUTFILE --double --minheight MINHEIGHT PE visualizer options: -h, --help show this...

CVE-2016-2098

CVE-2016-2098 Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data. Explanation: This issue comes from the usage of the render method on user-supplied data. The method render is usually used to render a page from a template, but render method also allows...

Android-Imgui-Template

Android ImGui Template Android menu template using Zygisk + ImGui. https://github.com/user-attachments/assets/816113d9-611d-4909-a08e-0f4e8ab6d03b Requirements Android NDK r27 ndk;27.0.12077973 Build Locally root@kitploit: export ANDROIDNDKHOME=/path/to/ndk/27.0.12077973 $ANDROIDNDKHOME/ndk-build...

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

CVE-2023-33410

CVE-2023-33410 Minical 1.0.0 is vulnerable to CSV Injection. Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: Navigate to the Accounting module and click on Create New Customer. Step 2: Enter the payload in the Name field and Click on Create...

systempi

systempi Real-time Raspberry Pi system monitoring dashboard for Linux terminals with live telemetry, hardware health analysis, and low-flicker rendering. FEATURES Real-time CPU, RAM, swap, disk, and network monitoring Raspberry Pi hardware telemetry through vcgencmd Power, throttling, undervoltag...

Next.js_exploit_CVE-2024-34351

csr-rsc-ssg-isr-ssr-ssrf This repo can be used as support to present one or more meetups. The path is as follows... "CSR" Client Side Rendering: React as a standard SPA library "RSC" React Server Components: execution of React components only on the server side "SSG" Static Site Generation:...

react16-ssr

CVE-2018-6341 https://vulners.com/cve/CVE-2018-6341 Un PoC simple para reproducir la vulnerabilidad XSS Pasos npm i npm run start Ve a localhost:3006...

CVE-2020-27603-bbb-libreoffice-poc

CVE-2020-27603-bbb-libreoffice-poc Proof of Concept of Libreoffice file exfiltration vulnerability in Big Blue Button These ODT files show how to exploit a file exfiltration vulnerability that can happen with server-side Libreoffice rendering, e.g. BigBlueButton. Background:...

xcrawl3r

xcrawl3r xcrawl3r is a command-line utility designed to recursively spider webpages for URLs. It works by actively traversing websites - following links embedded in webpages, and parsing files including sitemaps & robots.txt - to uncover every URL. Unlike xurlfind3r that doesn't interact directly...

SGLang-0.5.9-RCE

SGLang SSTI to RCE PoC — Unsandboxed Jinja2 Chat Template Rendering CVE-2026-5760 Remote Code Execution via Server-Side Template Injection SSTI in SGLang's reranking endpoint. A malicious GGUF model file with a crafted tokenizer.chattemplate achieves arbitrary code execution when loaded into SGLa...

Astro SSR - Server-Side Request Forgery

Astro before 5.17.3 and @astrojs/node before 9.5.4 are vulnerable to full-read SSRF due to improper Host header validation in error page rendering, allowing attackers to redirect requests and access internal resources. id: CVE-2026-25545 info: name: Astro SSR - Server-Side Request Forgery author:...

Astro SSR - Open Redirect

Astro 5.2.0 through 5.12.7 contains an open redirect caused by improper handling of paths with double slashes in trailing slash redirection logic, letting attackers redirect users to arbitrary external domains, exploit requires on-demand SSR with Node or Cloudflare adapters. id: CVE-2025-54793...

reDOM

reDOM root@kitploit: ██████╗ ███████╗██████╗ ██████╗ ███╗ ███╗ ██╔══██╗██╔════╝██╔══██╗██╔═══██╗████╗ ████║ ██████╔╝█████╗ ██║ ██║██║ ██║██╔████╔██║ ██╔══██╗██╔══╝ ██║ ██║██║ ██║██║╚██╔╝██║ ██║ ██║███████╗██████╔╝╚██████╔╝██║ ╚═╝ ██║ ╚═╝ ╚═╝╚══════╝╚═════╝ ╚═════╝ ╚═╝ ╚═╝ Una extensión de Burp...

research-labs

Researcher's labs This repository contains a number of intentionally vulnerable applications that you can use to explore vulnerabilities found by PortSwigger Research. Note that you can find many free online labs designed by PortSwigger Research in the Web Security Academy. Table of contents...

xwiki-cve-2025-24893

XWiki SolrSearch Unauthenticated RCE CVE-2025-24893 Contributors White Hat School 4th Cohort, Class 25 임두연@endusdksla Summary XWiki interprets wiki syntax and macros on the server side and renders them. The issue is that the Main.SolrSearch page is open to guests, yet it evaluates the user input...

Exploit-CVE-2021-21086

CVE-2021-21086 Exploit This exploit allows to execute a shellcode in the context of the rendering process of Adobe Acrobat Reader DC 2020.013.20074 and earlier versions on Windows 10. Note: the shellcode used in this example pops a calc. For it to work you must disable Adobe Reader's sandbox or y...