CVE-2024-32004

Create tmp repo, set uploadpack.allowfilter to true git init tmp git -C tmp config uploadpack.allowfilter 1 Clone evil from tmp repo git clone --filter=blob:none --no-local --no-checkout tmp evil rm -rf tmp Configure remote filter script git -C evil config remote.origin.uploadpack...

CVE-2026-75616

CVE-2026-75616 Authenticated OS command injection in the TP-Link Archer C20 v6 web management interface. BPA WAN configuration values are passed to system without adequate neutralization, allowing an authenticated administrator on the adjacent network to execute commands as root. Discovered and...

PT-2026-110721

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create'DOMDocument'.loadHTMLFile...

PT-2026-110896

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...

PT-2026-110655

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.7.0 through 0.9.3 Description A server-side request forgery SSRF issue exists where API clients can access internal addresses. By enabling link preview config on the '/crawl' endpoint, an attacker can provide a controlled...

CVE-2026-109237: Deserialization of Untrusted Data

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with apitoken set to an env reference via /config/dump to read SECRETK...

WordPressMassExploiter

WordPressMassExploiter Mass exploiter of CVE-2015-1579 for WordPress CMS This mass exploiter is based on CVE-2015-1579, discovered by CLAUDIO VIVIANI https://www.exploit-db.com/exploits/36554/ How it works: 1 - I use Selenium Framework to make the search on google. 2 - The results of search, are...

CVE-2024-3400

CVE-2024-3400 PoC for educational purposes only. only use on servers you have permission to test. How-To-Use deps: $ pip install rich scan targets.txt： $ python run.py -f targets.txt -t 10 - Sending 102 requests... + Requests sent. Writing check file... - Polling 36... - Checking...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs is a lightweight and self-hosted Git service similar to a private version of GitHub, designed to run easily on low-resource servers. The CVE-2025-8110 vulnerability is a critical security flaw that allows an attacker to bypass path restrictions by using symlinks. By...

gixy

GIXY Resumen Gixy es una herramienta para analizar la configuración de Nginx. El objetivo principal de Gixy es prevenir configuraciones de seguridad incorrectas y automatizar la detección de fallos. Actualmente, las versiones de Python compatibles son 2.7, 3.5, 3.6 y 3.7. Aviso: Gixy ha sido...

CVE-2026-73678-PoC

CVE-2026-73678 — MindsDB Minds Platform Unauthenticated RCE CVSS 10.0 CVSS 10.0 Critical · CWE-94 / CWE-306 · GHSA-jcxw-h8ph-pxpv · VulnCheck Summary Minds Platform the open-source backend of mindsdb/mindshub, previously mindsdb/minds-platform exposes POST /api/v1/responses/ an OpenAI-compatible...

n8n-vulnerability-detection

n8n Vulnerability Detection Automated Nuclei templates for detecting n8n vulnerabilities. Created by@rxerium Overview Automated CVE detection templates for n8n Workflow Automation, with daily monitoring and template generation from GitHub Advisories, ProjectDiscovery, and NVD. Statistics : 3 CVEs...

CVE-2022-36162

CVE-2022-36162 Suggested description pdftoroff hovacui 1.1.0 is affected by: Command execution. The impact is: execute arbitrary code local. The component is: hovacui.c, line 1574. The attack vector is: To exploit the vulnerability, you just have to change HOME environment variable, put some...

BruteRatel-DetectionTools

BruteRatel-DetectionTools A collection of Tools and Rules for decoding Brute Ratel C4 badgers All tools and rules are based on samples identified by PaloAlto in their report https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ Yara Rule The yara rule has been tested against the samples includ...

Malicious code in @coopeuch/config (npm)

Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope registry when an organization's scope-to-registry mapping...

CVE-2023-23752

Joomla Unauthenticated Information Disclosure Exploit CVE-2023-23752 Exploit Description This repository contains an exploit for a vulnerability named "Joomla Unauthenticated Information Disclosure" CVE-2023-23752. Please note that this is merely a proof-of-concept script created for educational...

laforge

Laforge Marco de automatización de infraestructura para competiciones de seguridad Laforge permite el desarrollo rápido de infraestructura para competiciones de seguridad informática. Mediante un lenguaje de configuración simple e intuitivo, Laforge gestiona un grafo de dependencias y el estado d...

Malicious code in @coopeuch/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope...

MAL-2026-17762 Malicious code in @coopeuch/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope...

CVE-2026-108584

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the...