CVE-2026-20896

Proof of Concept Code CVE-2026-20896 This script automates the exploitation of the logic flaw in Gitea's API route validation, allowing to force the server to grant a valid administrative token through a Directory Traversal attack in the authorization header. root@kitploit: !/usr/bin/env python3...

WebLogic-SSRF_CVE-2014-4210

WebLogic-SSRFCVE-2014-4210 Weblogic SearchPublicRegistries SSRFCVE-2014-4210 Exploit Script based on Python3 Usage optional arguments: -h, --help show this help message and exit -u U Single Target URL -uf UF Read URLs from file -p P Only scan specified ports -sn SN Only scan specified subnets -sf...

CVE-2026-31431-exploit_py2_py3

CVE-2026-31431-exploitpy2py3 A CVE-2026-31431 script compatible with both Python 2 and Python 3 Usage: python2/3 exploitpy2py3.py escalate Reference from: https://github.com/Sndav/CVE-2026-31431-Advanced-Exploit...

slater

Slater Current version:v0.25.2 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

CVE-2026-29955

KubePlus KubeconfigGenerator Command Injection Vulnerability This vulnerability exists in the kubeconfiggenerator component of KubePlus, allowing attackers with HTTP interface access to inject shell commands via the chartName parameter, execute arbitrary code as root within the container, and ste...

GitMiner3

Autor: UnkL4b Site: bravul.com Blog: unkl4b.github.io Github: UnkL4b X: @UnkL4b WARNING root@kitploit: +---------------------------------------------------+ | DEVELOPERS ASSUME NO LIABILITY AND ARE NOT | | RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY | | THIS PROGRAM |...

CVE-2026-29145-Everything

CVE-2026-29145 Everything Apache Tomcat CLIENTCERT + OCSP soft-fail bypass complete reproduction environment, exploit traffic captures, and Suricata detection rule writing materials. For authorized security research and detection rule development only. Do not use on unauthorized systems...

gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux FUJIFILM strd parsing leading to out-of-bounds read/write

A flaw was found in GStreamer gst-plugins-good avidemux. When parsing FUJIFILM metadata in an AVI strd chunk, gstavidemuxparsestrd decrements a remaining-length counter by fixed offsets 98 and 10 bytes without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 byte...

CVE-2026-79971

Dell Secure Connect Gateway (SCG) 5.0 contains an Improper Sanitization of Custom Special Characters vulnerability that allows an unauthenticated remote attacker to perform script injection . The affected versions are SCG 5.0 Appliance prior to 5.36.00.16 and SCG 5.0 Application prior to 5.36.00....

EUVD-2026-75012

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Sanitization of Custom Special Characters vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to scri...

CVE-2026-79971

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Sanitization of Custom Special Characters vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to scri...

CVE-2025-46819

CVE-2025-46819 – Redis Lua Long-String Delimiter Out-of-Bounds Read Malformed long-string delimiter causing Lua lexer OOBs read on Redis 8.2.1. Overview Lua's long-string parser in Redis 8.2.1 mishandles malformed =... sequences, returning sentinel values that lead to buffer underflows or excessi...

CVE-2025-8088-WinRAR-builder

CVE-2025-8088-WinRAR-builder A POC exploit for WinRAR vulnerability CVE-2025-8088 affecting versions 7.12 and lower 🚀 How It Works 1. Creates a Rar embed with other payloads 2. Using Multiple ADS Streams 🔄 - Attaches payload streams with different path traversal depths 3. Manipulates RAR Headers ...

Spring4Shell-CVE-2022-22965.py

Spring4Shell-CVE-2022-22965.py Script to check for Spring4Shell vulnerability Tested on https://github.com/lunasec-io/Spring4Shell-POC/blob/master/Dockerfile...

CVE-2026-34160

CVE-2026-34160 — Unauthenticated SSRF in Chamilo LMS via PENS plugin pens.php Severity : High CVSS 8.6 CWE : CWE-918 Server-Side Request Forgery Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-g2xj-4cch-j276 NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-34160 Credit ...

Chimera

Chimera es un script de ofuscación de PowerShell brillante y muy improvisado diseñado para evitar AMSI y soluciones antivirus. Digiere PS1 maliciosos conocidos por activar AV y utiliza sustitución de cadenas y concatenación de variables para evadir firmas de detección comunes. Chimera fue creado...

Bash-Script-CVE-2018-16763

This repository does not have a README...

CVE-2021-20294-POC

CVE-2021-20294-POC Jan 21 2023, Altin tin-z, github.com/tin-z Poc download and compile root@kitploit: wget https://ftp.gnu.org/gnu/binutils/binutils-2.35.tar.gz && tar -xzvf binutils-2.35.tar.gz cd binutils-2.35 && ./configure && make && cd .. gcc -shared -fPIC poc.c -o poc.so...

CVE-2025-54123

CVE-2025-54123 Hoverfly Command Injection to RCE PoC Overview This repository contains a Python proof-of-concept PoC script for interacting with Hoverfly instances affected by CVE-2025-54123. The script supports: Authentication using username/password credentials Authentication using an existing...

bugbounty_tools

bugbountytools Collection of scripts and tools used during bug bounty work. This will be the location of my automation scripts created for my own personal use, and occassionally public released Contact: For questions, comments or request make a psot to my X account not in DM and I will do what I...