shellex

shellex WARNING : the ugliest code in the world C-shellcode to hex converter. Please, consider make a donation: https://github.com/sponsors/therealdreg Handy tool for paste & execute shellcodes in IDA PRO, gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger & 010 editor. Are you having...

Exe2Image

Exe2Image A simple utility to convert EXE files to PNG images and vice versa. Download: https://github.com/OsandaMalith/Exe2Image/releases Screenshots Putty.exe converted to an image...

norimaci

Norimaci "Norimaci" — это простая и легковесная песочница для анализа вредоносных программ под macOS. Этот инструмент был вдохновлён "Noriben". Norimaci использует возможности OpenBSM или Monitor.app для мониторинга системной активности macOS вместо Sysinternals Process Monitor procmon. Norimaci...

WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect

WordPress WebP Converter for Media 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-25074 info: name: WordPress WebP Converter for Media 4.0.3 - Unauthenticated Open Redirect author:...

CHIYU TCP/IP Converter - Carriage Return Line Feed Injection

CHIYU TCP/IP Converter BF-430, BF-431, and BF-450 are susceptible to carriage return line feed injection. The redirect= parameter, available on multiple CGI components, is not properly validated, thus enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized...

CVE-2009-1330

CVE-2009-1330 Exploit for buffer overflow in Easy RM to MP3 Converter 2.7.3.700 CVE-2009-1330 Based on: pwntools msfvenom / reversetcp payload ropper x64dbg Easy RM to MP3 Converter 2.7.3.700 Vulnerable app available at https://www.exploit-db.com/exploits/10374...

CVE-2024-11392

CVE-2024-11392 Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability High-level overview and effects of the vulnerability: The vulnerability allows an attacker to execute arbitrary code on the host machine by supplying a malicious configuratio...

PowerShell-for-Hackers

2022 Hak5 хакер года Содержание 1. Описание 2. Функции 3. Контакты 4. Благодарности Функции PowerShell для хакеров 🤓💻 В настоящее время я занимаю первое место среди авторов payload'ов для Hak5. Я решил создать этот репозиторий, чтобы поделиться всеми функциями, которые я придумал для разработки...

pwnkit-exploit

pwnkit CVE-2021-4034 권한 상승 익스플로잇 샘플 이 저장소는 pkexec의 로컬 권한 상승 취약점인 CVE-2021-4034에 대한 익스플로잇을 포함합니다. 이 구현은 CVE 공개 문서에 설명된 내용을 기반으로 하며, 해당 문서를 읽어보시기 바랍니다. 이 익스플로잇이 시스템에서 작동한다면, 시스템이 취약하다는 의미입니다. 이를 해결하려면 polkit을 패치된 버전으로 업데이트하거나, 다음 명령으로 pkexec의 setuid 비트를 비활성화하세요: root@kitploit: $ sudo chmod a-s $whi...

CVE-2017-8367

CVE-2017-8367 PoC exploit for vulnerability CVE-2017-8367 Easy Mov Converter Register functionality Stack-Based Buffer Overflow. Usage Execute script and the file POCPayload.txt will be created containing the payload. root@kitploit: python3 payloadgeneratorCVE-2017-15950.py Open the output file o...

CVE-2026-55451

A flaw was found in gettext-converter. This vulnerability, known as prototype pollution, occurs in the js2i18next function when processing untrusted translation data. An attacker can craft malicious translation keys containing proto to modify the global Object.prototype. This can lead to a denial...

CVE-2026-55451

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

EUVD-2026-77634

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55451

CVE-2026-55451 is a prototype pollution vulnerability in gettext-converter (NPM, versions ≥1.0.3, ≤1.3.2). The js2i18next() function in lib/js2i18next.js splits nested translation keys on the key separator (default ##) and uses each segment as a dynamic object key without rejecting __proto__, con...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: phy: lynx-28g: Serialize concurrent physetmodeext calls to shared registers The protocol converter configuration registers PCC8, PCCC, and PCCD implemented by the driver control protocol converters across multiple lanes each...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: calling inputfreedevice on the allocated iiodev The current implementation of at91tsregister calls inputfreedevice on st-tsinput. However, the err label can be reached before the allocated iiodev is stored to...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: drm/virtio: fixed a NULL pointer dereference in virtiogpuconngetmodes drmcvtmode may return NULL, and we should check for this. This bug was discovered by syzkaller: FAULTINJECTION stacktrace: 168.567394 FAULTINJECTION: forcin...