metasploit-pentest-report

Authorized Penetration Test: Metasploit Lab Scope and Authorization All targets used in this project are explicitly authorized: Target| IP| Authorization Basis ---|---|--- Metasploitable2| 192.168.3.130| Self-hosted VM on isolated host-only network. Intentionally vulnerable VM built for security...

CVE-2018-18387

CVE-2018-18387 playSMS = 1.4.2 - Privilege escalation TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise. The attacker need to get access on the box where playSMS is installed and be able to edit playSMS...

CVE-2025-32206

CVE-2025-32206 - WordPress Processing Projects "LABCAT Processing Projects의 위험한 유형의 파일 무제한 업로드 취약점으로 인해 공격자가 웹 서버에 웹 셸을 업로드할 수 있습니다. 이로 인해 완전한 손상이 발생할 수 있습니다." 🧑‍💻 익스플로잇 설명 이 Python 익스플로잇 스크립트는 취약한 Processing Projects 플러그인버전 = 1.0.2을 사용하는 WordPress 사이트를 대상으로 합니다. 이 플러그인은 인증된 사용자의 파일 업로드를 부적절하게 처리하여...

Malicious code in translate-base-font (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0ae1970321abd04ddd957d3135ee1d2eb64acee031428fa8f3cbcb8c48504b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui.dist.min.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf50ae695b73c6662269893d9ac1f677ce5be474e9648bfa23cdfb35b1b04a3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in illusion-datalab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6004785b370b58ab360f70d7959fad47ec55ec609e8556217976fc405a610b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ashwesker-CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” A critical, unauthenticated vulnerability allowing full compromise of n8n servers 🆔 Overview Field| Details ---|--- CVE ID| CVE-2026-21858 Codename| Ni8mare Severity| 🔴 Critical CVSS Score| 10.0 Maximum Attack Vector| 🌐 Network Authentication Required| ❌ None User...

CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation

CVE-2026-21017 – LDAP Anonymous Bind Privilege Escalation Program Code Python ldap3 sim ldapanonsim.py - LDAP server allowing anonymous bind with write access from ldap3 import Server, Connection, ALL Simulated: real server would be misconfigured server = Server'ldap://localhost:389', getinfo=ALL...

Malicious code in @cat-gen/materia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 354c3f4dedaabc169ba0f7a5ccb99a5a77e7ef99c194854add673e7dac98d30f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17334 Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @redman89405/my-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58f8e0d965e65d298a38295487ebe0c363ea7da343649827903915cc655f3730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iban-validator-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fff3da0c4ead2e4f938efa16ad1cea92e872789a3b012edfed68526898cce4fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17284 Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

VIVOTEK Camera Firmware

ADVISORY SUMMARY Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

Malicious code in img-to-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7676788d88c2194b8d5c048decfbe06550798ce342af54f8975bc26422d10c53 On require of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended afte...

MAL-2026-17216 Malicious code in img-to-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7676788d88c2194b8d5c048decfbe06550798ce342af54f8975bc26422d10c53 On require of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended afte...

Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

MAL-2026-17218 Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...