37837 matches found
cromos
Cromos Cromos is a tool for downloading legitimate extensions of the Chrome Web Store and inject codes in the background of the application and more cromos create executable files to force installation via PowerShell for example, and also upload files to dropbox to host the malicious files...
SafeLine
SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋♂️ Discord | 中文版 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP...
Research_Successful_Errors
Successful Errors: New Code Injection and SSTI Techniques !NOTE This is the second version of the whitepaper based on the results I presented before releasing SSTImap version 1.3.1. Further improvements would be adapted for this format as version 1.2 of the research at a later date. Payloads...
pylane
pylane 简体中文 Pylane is a python vm injector with debug tools, based on gdb and ptrace. Pylane uses gdb to trace python process, inject and run some code in its python vm. Usage use inject command to inject a python script in an process: root@kitploit: pylane inject use shell command to inject an...
memhunter
Memhunter Automated hunting of memory resident malware at scale This project is WORK IN PROGRESS. Expect feature changes and binary releases on the upcoming weeks. Overview Memhunter is an endpoint sensor tool that is specialized in detecing resident malware, improving the threat hunter analysis...
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit
Microsoft-Office-Word-MSHTML-Remote-Code-Execution-Exploit CVE-2021-40444 EXPLOIT TO USE IN METASPLOIT, ALLOWS ATTACKERS TO GET AN REMOTE CODE EXECUTION THROUGH MICROSOFT OFFICE WORD BY INJECTING MALICIOUS CODE IN THE FILE...
PageTableInjection
PageTableInjection Code Injection, Inject malicious payload via pagetables pml4. Introduction This is just a proof-of-concept of the page table injection technique to inject malicious code into the arbitrary user processes. On Windowsand some modern OSes, every process has a its PML4 a.k.a...
opentaint
The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | | | | | | | | | | | | | | | | | | |...
SSTImap
SSTImap This project is based on Tplmap. SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive...
CVE-2022-22947
Spring Cloud Gateway Example: python3 exploit.py http://localhost:8080 'id' + Stage deployed to /actuator/gateway/routes/rtxhovup + Executing command... + getting result... + Stage removed! uid=0root gid=0root groups=0root...
CVE-2024-25180
CVE-2024-25180 Overview pdfmake is a pure JavaScript client/server PDF printing library. The affected versions of this package are vulnerable to arbitrary code injection. An attacker can execute arbitrary code by sending a crafted POST request to the /pdf path. The attacker can execute arbitrary...
cve-2022-22947-spring-cloud-gateway
漏洞简介 Spring Cloud Gateway 是 Spring Cloud 的一个全新项目，该项目是基于 Spring 5.0，Spring Boot 2.0 和 Project Reactor 等技术开发的网关，它旨在为微服务架构提供一种简单有效的统一的API路由管理方式。 前段时间springCloud Gateway被爆致命RCE CVE ,cve信息显示当应用程序启用和暴露Spring Cloud Gateway的Gateway Actuator endpoint时，会受到远程代码注入攻击，攻击者发送恶意请求从而可远程执行任意代码。目前受影响的版本如下： 3.1.0 3.0...
CVE-2026-9160
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2019-8331
英文 说明 CVE-2019-8331 是 Bootstrap 中的一个跨站脚本（XSS）安全漏洞。Bootstrap 是一个广泛用于网站和移动应用开发的 JavaScript 库。该漏洞是由于 Bootstrap 未能正确过滤随 tooltip 或 popover 元素的 data-template 属性传入的数据所致，使攻击者能够将恶意代码注入网页。 如果攻击者能够控制将显示为 tooltip 或 popover 的数据，就可能发生此类攻击。当用户触发 tooltip 或 popover 时，恶意代码会被注入网页，并可能在用户浏览器中执行。 此漏洞已在 Bootstrap 4.3.1...
CVE-2022-22947-POC
Spring-Cloud-Gateway-CVE-2022-22947 Spring Cloud Gateway远程代码执行漏洞的安全公告。该漏洞为当Spring Cloud Gateway启用和暴露 Gateway Actuator 端点时，使用 Spring Cloud Gateway 的应用程序可受到代码注入攻击。攻击者可以发送特制的恶意请求，从而远程执行任意代码。 【受影响版本】 Spring Cloud Gateway = 3.1.1 Spring Cloud Gateway = 3.0.7 Spring Cloud Gateway 是基于 Spring Framework 和...
CVE-2023-49314
CVE-2023-49314 macOS 上的 Asana Desktop 2.1.0 由于特定的 Electron Fuses 允许代码注入。通过 RunAsNode 和 enableNodeCliInspectArguments 等设置对代码注入的保护不足，因此可以使用 electroniz3r 执行攻击。 有一个工具旨在自动化搜索 Electron 漏洞的过程：https://github.com/r3ggi/electroniz3r 我们将检查应用程序是否易受攻击： 现在我们可以注入一个绑定 shell： 我们得到了 shell 要了解更多关于 Electron 桌面应用的信息：...
CVE-2026-9160
CVE-2026-9160 is a template engine vulnerability in Arma Digital Media Inc. Website Template (affected through version 11092026 ). The root cause is improper neutralization of special elements in the template engine, which allows code injection . The vulnerability is rated CVSS 4.3 (MEDIUM) with ...
EUVD-2026-76158
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2026-9160 CSTI in Arma Digital's Website Template
Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...