overkill

Overkill Overkill is an exploit for a patched vulnerability affecting QNAP QTS. Due to the way QNAP discloses vulnerabilities, I'm unsure if this issue has a CVE or not. However, it was likely patched in November 2020 and April 2021. The n-day was "discovered" while doing diff analysis for...

ruby-nmap

ruby-nmap Código fuente Problemas Documentación Descripción Una API de Ruby para nmap, la herramienta de exploración y escáner de seguridad/puertos. Permite automatizar nmap y analizar archivos XML de nmap. Características Proporciona una API de Ruby para automatizar nmap. Proporciona un analizad...

EUVD-2026-84820

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

libxml2-exploit

libxml2-exploit An example exploit for CVE-2017-7376 Install Download this repo and a vulnerable version of libxml2, e.g. v2.7.7: root@kitploit: git clone https://github.com/brahmstaedt/libxml2-exploit.git cd libxml2-exploit wget https://github.com/GNOME/libxml2/archive/v2.7.7.zip unzip v2.7.7.zi...

CVE-2016-3141

CVE-2016-3141 1. Vulnerability Detail. Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service memory corruption and application crash or possibly have unspecified other impact by triggering a...

liblapith

Liblapith - a library for parsing Nessus results files Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Felix Ingram, felix dot ingram at nccgroup dot com http://www.github.com/nccgroup/liblaptith Released under LGPL. See LICENSE for more information Example...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...

CVE-2024-34102

CVE-2024-34102 Las versiones 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 y anteriores de Adobe Commerce se ven afectadas por una vulnerabilidad de Restricción Incorrecta de Referencia a Entidades Externas XML 'XXE' que podría resultar en la ejecución de código arbitrario. Un atacante podría explotar esta...

CVE-2021-29447-PoC

CVE-2021-29447 Prueba de Concepto root@kitploit: ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Escrito por Isa Ebrahim - 0xRar en enero de 2023 ═══════════════════════════════════════════════════════════════════════════ Título: Problema de análisis XML en la librería multimedia de WordPress que...

CVE-2022-2414-POC

CVE-2022-2414-POC El acceso a entidades externas al analizar documentos XML puede provocar ataques de entidad externa XML XXE. Esta falla permite que un atacante remoto pueda potencialmente recuperar el contenido de archivos arbitrarios enviando solicitudes HTTP especialmente diseñadas. Lo...

crack-0.1.8-fixed

= crack Análisis realmente simple de JSON y XML, extraído de Merb y Rails. El analizador XML está extraído de Merb y el analizador JSON de Rails. No me atribuyo el mérito, solo los empaqueté para que todos los disfruten y los usen fácilmente. == nota sobre versiones Las versiones se etiquetan en...

CVE-2017-9805

CVE-2017-9805: Apache Struts 2 S2-052 RCE Analizi Bu depo, Apache Struts 2 S2-052 üzerindeki XStream deserialization zafiyetine yönelik teknik detayları ve PoC Proof of Concept çalışmasını içermektedir. 📌 Zafiyet Bilgileri CVE Kodu: CVE-2017-9805 Zafiyet Türü: Uzaktan Kod Çalıştırma RCE Risk...

MAL-006

MAL-006: XML External Entity in "Try It" in WSO2 ESB An error-based XML External Entity XXE attack was identified in the WSO2 ESB "Try It" tool. Why no CVE? The vendor replied that "Try it is recommended to be disabled in production" and no public disclosure was made. Requirements: This...

CVE-2025-7766

CVE-2025-7766 Exploit PoC PoC para explotar la vulnerabilidad de entidad externa XML en CVE-2025-7766. Demuestra lectura de archivos /etc/passwd y callbacks HTTP fuera de banda. Autor : Byte Reaper CVE : CVE-2025-7766 Vulnerabilidad : Ejecución remota de código a través de entidad externa XML XXE...

CVE-2026-92987 roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

EUVD-2026-81624

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

ktor-xxe-poc

ktor-xxe-poc This is a proof-of-concept reproducing the security problem CVE-2023-45612. Versions Used Ktor: 2.2.3 xmlutil: 0.84.3 Java: 17.0.6 Gradle: 9.1.0 Python: 3.13.7 How to Run 1. Build and run the server: root@kitploit: ./gradlew build ./gradlew run 2. Test the XXE payload : root@kitploit...

CVE-2026-20224---XXE-Injection-en-Cisco-Catalyst-SD-WAN-Manager

CVE-2026-20224 - Cisco Catalyst SD-WAN Manager XXE Injection ⚠️ DISCLAIMER THIS TOOL IS EXCLUSIVELY FOR EDUCATIONAL AND RESEARCH PURPOSES This exploit is intended exclusively for authorized red team operations, penetration testing, and security research on systems where you have explicit written...

Linux Distros Unpatched Vulnerability : CVE-2026-92987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XM...

CVE-2020-4463

IBM Maximo Asset Management is vulnerable to Information Disclosure via XXE Vulnerability CVE-2020-4463 IBM Maximo Asset Management is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...