PhoneSploit-Pro

PhoneSploit Pro Android를 위한 스위스 아미 나이프. Python으로 작성된 올인원 해킹 도구로, ADB, scrcpy, Nmap, Metasploit-Framework를 사용하여 Android 기기를 원격으로 장악합니다. 목차 개요 스크린샷 기능 요구 사항 의존성 설치 시작하기 기기 설정 튜토리얼 호환성 도구 수동 설치 면책 조항 개발자 지원 개요 기기를 장악하세요. 중요한 모든 측면에서. USB 또는 Wi‑Fi로 연결한 후, 기기를 제어하고, 데이터를 추출하고, 카메라와 마이크를 스트리밍하고, 앱을 관리하...

CVE-2019-1253

CVE-2019-1253 AppXSvc 임의 파일 보안 설명자 덮어쓰기 권한 상승 이 취약점을 MSRC에 독립적으로 보고했지만, CVE-2019-1253에 대한 수정이 이 문제도 해결했기 때문에 제 제출은 중복으로 판명되었습니다. 제 PoC는 Chris Danieli 또는 Nabeel Ahmed가 만든 것과 다릅니다. 이 익스플로잇은 대상 파일에 대한 'Full Control'을 제공하기 때문입니다. 제 연구는 원래 Nabeel Ahmed가 보고한 CVE-2019-0841에서 영감을 받았습니다...

Oracle WebLogic Server - Remote Command Execution

Oracle WebLogic Server 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised machine without entering necessary credentials. See...

CVE-2026-92805 UVdesk Community Skeleton through 1.1.8 Missing Authentication on the Installation Wizard

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints,...

porterminal v1.2.0

Hand a computer to an agent, full control, and watch it. One command, one URL. Also a slick terminal for your own phone. 1. uvx ptn 2. Hand the URL to an AI agent, or scan the QR yourself 3. Watch it work in any browser, and take over anytime !WARNING That complete URL is full access to this...

CareCam Pro IP Cameras

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to take full control of the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control...

Malicious code in btree-leaderboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ceaaf14d642f02835e10e1eb7de05ea911ecf2b72bc354305aa3d6bf874e4e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacklgszmx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326a185f0d36a9b1db29c212632e52f5f0e0105597b0b44e345d805871d41edc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackfoajna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 575021dd0f33d766c5b37fe60b4c5bcdbaeda054f9252c6ed62e9d358e8903c9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14721 Malicious code in 3layerdipstackdanp80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7ad51aca2a1256c94902657616735d1f145c72f449b0beadf0fd3f3ccd6fd1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-59322

CVE-2026-59322...

Malicious code in zip-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a990db9c306a25a8b0663088429ef5cf3939c32a9f8d6b1fc3066e8bf42a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13833 Malicious code in prezdentkxheiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b524c1b4d84ba3f109eddb254753a02dac72fa61397c4f03dbcbb814c6aaa68f The package contains only index.html declared as main and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes ...

MAL-2026-13812 Malicious code in hfkcdyuwbdx1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c3d2f214c9d9ba8dcc912ba18272665044c75eb18d8335c18b959687d45cbdb Package [email protected] was scanned but produced no concrete findings from either rule-based checks or contextual code tracing. The package name i...

MAL-2026-13669 Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

CVE-2026-17032

CVE-2026-17032 concerns Supsystic Multiple Pro Plugins. The issue arises from a vendor update server compromise, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and sensitive data and grants full control of affected sites. The records indicate a cr...

MAL-2026-11504 Malicious code in accounts-final-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e67b952090179c0e7ed57045bf117d0cc14ca7d832ddce2963c4f2049b66bb Requiring accounts-final-form auto-runs setup.js via process.nextTickbootstrap in index.js. setup.js selects a platform-specific asset path...

MAL-2026-11464 Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...

MAL-2026-11486 Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...