#1Static and dynamic code analysis, SAST, DAST, and code review tools.
Kitploit recommended
jeanback1/cve-2023-30253-exploitCVE-2023-30253 — Dolibarr ERP/CRM 17.0.0 RCE via PHP code injection (exploit educativo)
gcmurphy/chk_log4jSome siimple checks to see if JAR file is vulnerable to CVE-2021-44228
kpatsakis/cve-2025-67221Documentation and reproduction code for CVE-2025-67221, a denial-of-service vulnerability in orjson's dumps() function caused by uncontrolled…
drkim-dev/cve-2025-62429Proof-of-concept for authenticated remote code execution in ClipBucket via PHP code injection in update_launch.php. Includes web shell deployment and…
sivaadityacoder/cve-2026-22038Detailed analysis of CVE-2026-22038, a high-severity vulnerability in AutoGPT Stagehand blocks that logs API keys in plaintext, including root cause,…
m8seven/cve-2026-11837-ansible-posix-authorized-keyCVE-2026-11837: local privilege escalation in the ansible.posix authorized_key module via symlink-following chown. Technical writeup; sibling of…
alexb616/sessionreaper-cve-2025-54236PoC Magento Session Reaper - CVE-2025-54236
bekwiner/cve-2026-47777Detailed technical analysis of CVE-2026-47777, a high-severity authorization bypass in Mastodon's Featured Collections federation pipeline, including…
junfuture1103/cve-2026-55511Remote Code Execution (RCE) in Yamcs Mission Control System via Java Statement Injection in Yarch SQL Double-Quoted IdentifiersRemote Code Execution…
gmh5225/actions-secretsAdding this GitHub Action will scan your repository for sensitive data in your source code. We find things like passwords, server host strings, API…
at190510-cuong/cve-2026-38165-ssti-CVE-2026-38165 (SSTI)
perufitlife/dotclaude-securityScan a repo's .claude/ config (settings.json hooks, MCP servers, env, allowed-tools) for the RCE & API-key-exfiltration footguns (CVE-2025-59536,…
rajus-agent/orbit-tracerOrbit Tracer Security Agent for intelligent security remediation. Traces vulnerability blast radius using Orbit's knowledge graph, scores risk,…
funixone/exploit-cve-2026-8832Automated RCE exploit for WordPress WPCode Lite v2.3.5 (CVE-2026-8832) with 8 built-in PHP payloads, XML-RPC bypass, and web-based interactive shell…
pabloopez/cve-2024-21534Proof-of-concept (PoC) exploit for JSONPath-plus vulnerability
zemarkhos/cve-2026-44403-wingftp-v8.1.2-poc-exploitCVE-2026-44403-WingFTP-v8.1.2-POC-Exploit
polosss/by-poloss..-..cve-2026-7515-pocUnauthenticated Local File Inclusion
gagaltotal/cve-2026-42533-nginxCVE-2026-42533 Nginx
