CVE-2019-12735

CVE-2019-12735 Este CVE fue corregido después de neovim 0.3.6 y vim 8.1.1365 POC root@kitploit: vim demo1.txt Shell remota 1. Crea el archivo de texto malicioso: root@kitploit: gcc makedemo3.c -o makedemo3 ./makedemo3 2. Compila el cliente en otra sesión: root@kitploit: nc -vlp 9999 3. Abre el...

boa-cve-2009-4496-analysis

CVE-2009-4496 — Análisis Defensivo de Vulnerabilidad Resumen Este repositorio documenta un análisis defensivo de CVE-2009-4496 , una vulnerabilidad histórica asociada con el servidor web Boa. El objetivo de este proyecto es examinar la vulnerabilidad desde una perspectiva de seguridad defensiva...

CVE-2024-36039_PoC

CVE-2024-36039: PoC de Inyección de Objetos a Inyección SQL en PyMySQL Un laboratorio de Prueba de Concepto PoC completo y reproducible para CVE-2024-36039 , que demuestra cómo una vulnerabilidad de Inyección de Objetos en PyMySQL versiones = 1.1.0 puede escalarse a una Inyección SQL completa...

CVE-2026-48813-POC

Flawfinder-ANSI-Exploit-POC Nella versione 2.0.19 di Flawfinder, non avviene alcuna sanificazione del nome del file durante l'analisi di nomi di file potenzialmente dannosi. I terminali noti come affetti sono basati su libvte, e l'esempio seguente mostra un mate-terminal. Questo exploit è stato...

Security update for broot (moderate)

openSUSE security update: security update for broot ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21675-1 Rating: moderate References: bsc1275994 Cross-References: CVE-2026-72847 CVSS scores: CVE-2026-72847 SUSE : 4.6...

CVE-2026-81696 openssl_encrypt before 1.4.9 Terminal Injection via info Command

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81695 openssl_encrypt before 1.4.9 Terminal Injection via key_id

opensslencrypt versions before 1.4.9 fail to escape attacker-controlled keyid values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious keyid containing escape sequences to repaint terminal output and forge authenticity verification blocks...

CVE-2026-81695

openssl_encrypt versions before 1.4.9 are affected by a terminal injection vulnerability. During decrypt auto-detection, attacker-controlled key_id values are printed to stderr without proper escaping, allowing an attacker to craft encrypted files containing escape sequences that repaint terminal...

EUVD-2026-67052

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

CVE-2026-81696

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata output by the info command. An attacker can craft malicious files containing escape sequences that repaint terminal output and forge verification information displayed to users. The fix is availabl...

CVE-2026-81696 openssl_encrypt before 1.4.9 Terminal Injection via info Command

opensslencrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users...

Astra Linux – Vulnerability in util-linux

The wall function in util-linux up to version 2.40 is often installed with setgid and tty permissions. This allows escape sequences to be sent to other users’ terminals via argv. Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocke...

CVE-2026-75483 powerlevel10k Control Character Injection via package.json Version

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directori...

PT-2026-76810

Name of the Vulnerable Software and Affected Versions powerlevel10k affected versions not specified Description The software fails to neutralize control characters within the version field of a package.json file when rendering the package prompt segment. This allows an attacker to inject raw esca...

UBUNTU-CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-72913

A flaw was found in Kitty, a cross-platform GPU based terminal. This vulnerability allows an attacker to achieve arbitrary code execution by chaining specific escape sequences @kitty-echo and @kitty-ssh when a user displays untrusted terminal data. These sequences write unauthenticated data to th...

CVE-2026-73035 npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --form...