EUVD-2026-67094

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

sublert

root@kitploit: / / / / / / / / \ / / / / / / / / / / / // / // / / / / / / //,/.//// / Author: Yassine Aboukir Version: 1.4.7 What's this about? Sublert is a security and reconnaissance tool that was written in Python to leverage certificate transparency for the sole purpose of monitoring new...

sublert

root@kitploit: / / / / / / / / \ / / / / / / / / / / / // / // / / / / / / //,/.//// / Autore: Yassine Aboukir Versione: 1.4.7 Di cosa si tratta? Sublert è uno strumento di sicurezza e ricognizione scritto in Python per sfruttare la trasparenza dei certificati con il solo scopo di monitorare...

4nonimizer

यदि आप 4nonimizer को पसंद करते हैं, तो कृपया अपनी इच्छानुसार हमारी सहायता करें! 4nonimizer क्या है? यह एक bash स्क्रिप्ट है जो इंटरनेट ब्राउज़ करने के लिए उपयोग किए जाने वाले सार्वजनिक IP को अनाम बनाने के लिए है, जो TOR नेटवर्क और विभिन्न VPN प्रदाताओं OpenVPN से कनेक्शन प्रबंधित करती है, चाहे वे...

CVE-2021-43616

Repository che dimostra CVE-2021-43616 / https://github.com/npm/cli/issues/2701 Rimuovi la cartella nodemodules ed esegui npx npm@8 ci, potrai vedere come npm installa la versione 2.2.x 2.2.16 al momento di questo commit anche se package-lock.json richiede la 2.0.0 root@kitploit: cat...

subscraper

SubScraper Übersicht :smallbluediamond: Verwendung :smallbluediamond: Beitragen SubScraper ist ein Tool zur Subdomain-Enumeration, das verschiedene Techniken einsetzt, um Subdomains eines gegebenen Ziels zu finden. Die Subdomain-Enumeration ist besonders hilfreich bei Penetrationstests und Bug...

EUVD-2026-67053

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

CVE-2020-8277

CVE-2020-8277 Solo per scopi educativi. Esecuzione rapida root@kitploit: clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" versio...

CVE-2026-72814

A flaw was found in actix-files. When a non-existing folder is provided as the servefrom argument to Files::new, the service incorrectly resolves request paths as relative to the application's working directory. This allows an attacker to access unintended files, leading to information disclosure...

CVE-2026-11112-XXE-via-SVG-Image-Upload

CVE-2026-11112 – XXE tramite caricamento di immagini SVG Codice del programma Python Flask + parser XML root@kitploit: xxeuploadserver.py - Uploads SVG, renders with lxml resolving entities from flask import Flask, request from lxml import etree app = Flaskname @app.route'/upload', methods='POST'...

CVE-2024-23653

root@kitploit: syntax=docker.io/zdfa/evilerfile FROM alpine RUN grep Cap /proc/self/status root@kitploit: sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. \ --local dockerfile=. root@kitploit: ➜ cp sudo bin/buildctl build \ --frontend=dockerfile.v0 \ --local context=. ...

CVE-2025-32463

CVE-2025-32463 शोषण --- प्रूफ-ऑफ-कॉन्सेप्ट PoC अस्वीकरण: इस रिपॉजिटरी में एक प्रूफ-ऑफ-कॉन्सेप्ट शामिल है जो केवल शैक्षिक, रक्षात्मक अनुसंधान और अधिकृत पैठ परीक्षण के लिए है। उन सिस्टमों पर इस कोड का उपयोग न करें जिनके आप मालिक नहीं हैं या जिनके परीक्षण के लिए आपके पास स्पष्ट लिखित अनुमति नहीं है।...

CVE-2026-26030-Microsoft-Semantic-Kernel-1.39.4-RCE

Microsoft Semantic Kernel 1.39.4 – रिमोट कोड एक्ज़ीक्यूशन PoC CVE-2026-26030 InMemoryVectorStore में अविश्वसनीय फ़िल्टर एक्सप्रेशन असुरक्षित एट्रिब्यूट रिज़ॉल्यूशन की अनुमति देते हैं, जिससे builtins / globals ट्रैवर्सल के माध्यम से मनमाना Python कोड एक्ज़ीक्यूशन संभव होता है। 👤 लेखक Mohammed Idre...

CVE-2026-59278 In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the...

CVE-2026-59278

Spring for Apache Kafka is vulnerable to SSRF via DNS resolution in its JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper classes. Because java.net is included in the default trusted packages list, an external Kafka producer can inject a java.net.InetAddress type through the spring_json_header_t...

Nim_DInvoke

Nim DInvoke Implementação de D/Invoke em Nim Todos os binários Nim normalmente expõem as mesmas 58-60 funções da API do Windows: Todas as outras funções da API do Windows normalmente são resolvidas em tempo de execução via GetProcAddress e LoadLibraryA, como mencionado em OffensiveNim ou neste po...

zig-pe

zig-pe Caricatore PE riflessivo scritto in Zig. Carica ed esegue file PE nativi e .NET direttamente dalla memoria. Caratteristiche Pipeline di caricamento PE Analizza header DOS e NT PE32 e PE32+ a runtime Mappa le sezioni nella memoria allocata Risolve le importazioni per nome e ordinale, thunk...

SSRF-CVE-2020-15002

Краткое описание Логика проверки URL, применяемая при обработке /appsuite/api/oxodocumentfilter&action=addfile, имеет три дефекта, которые могут быть использованы для выполнения атаки SSRF типа «время проверки — время использования» ToCToU. Эта проблема позволяет злоумышленникам выполнять HTTP...

EUVD-2026-66823

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

susvibes-jupyter-server-cve-2026-35397

SusVibes-Benchmark-Aufgabe: Pfadauflösung des Jupyter-Server-Inhaltsverzeichnisses Dieses Repository enthält eine vollständige SusVibes-ähnliche Benchmark-Aufgabe, die aus einem echten Python-Sicherheitsfix im Jupyter Server erstellt wurde. Die Aufgabe soll bewerten, ob ein Agent die maskierte...