metasploit-pentest-report

Prueba de Penetración Autorizada — Laboratorio de Metasploit Alcance y Autorización Todos los objetivos utilizados en este proyecto están explícitamente autorizados: Objetivo| IP| Base de Autorización ---|---|--- Metasploitable2| 192.168.3.130| VM autoalojada en una red aislada solo-host...

CVE-2018-18387

CVE-2018-18387 playSMS = 1.4.2 - Privilege escalation TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise. The attacker need to get access on the box where playSMS is installed and be able to edit playSMS...

CVE-2025-32206

CVE-2025-32206 - WordPress Processing Projects “LABCAT Processing Projects 中存在危险类型文件无限制上传漏洞，攻击者可将 Web Shell 上传至服务器，从而导致完全失陷。” 🧑‍💻 利用说明 此 Python 利用脚本针对使用存在漏洞的 Processing Projects 插件（版本 = 1.0.2）的 WordPress 站点。该插件未能正确处理来自已认证用户的文件上传，允许其上传包含可执行 PHP 代码（Web Shell）的任意 ZIP 文件。 利用脚本： 1. 以管理员身份登录目标 WordPress...

CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation

CVE-2026-21017 – Escalada de Privilegios por Bind Anónimo LDAP Código del programa simulación Python ldap3 root@kitploit: ldapanonsim.py - LDAP server allowing anonymous bind with write access from ldap3 import Server, Connection, ALL Simulated: real server would be misconfigured server =...

Ashwesker-CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” Una vulnerabilidad crítica sin autenticación que permite el compromiso total de los servidores n8n 🆔 Resumen...

Malicious code in vinnleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da2c109f5566555ce8963688bfbb309220aa3fca570bcee74d32b1a8fcc83c75 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in xbailsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ff4aa1a565659c7106700fc5b7c355770ec8fc6bd62c0d9a4f8efce56bf09f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in amprem-activator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bb73ef0a9130c0751f253465a40f102cddb6cecdec2835dd7cc9c0f4150efa1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in crypto-validates (npm)

[email protected] ships a dist/index.js identical to [email protected]: validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check through checkvalidator, and randomBytessize forwards freshly generated crypto.randomBytes output to the...

Malicious code in polygon-toolkits-validator (npm)

[email protected] exports Node crypto helper wrappers, but validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as action: "validator", content: btoainput through checkvalidator in dist/index.js, then returns true without validating...

Malicious code in pumpswap-sdk-v1 (npm)

[email protected] presents crypto helpers for the PumpSwap SDK, but validateinput base64-encodes its argument and POSTs it to https://pumpswap-sdk.maingoal.xyz/v1/check through checkvalidator in dist/index.js, and randomBytessize forwards the hex output of crypto.randomBytes to the same host...

MAL-2026-16088 Malicious code in pumpswap-sdk-v1 (npm)

[email protected] presents crypto helpers for the PumpSwap SDK, but validateinput base64-encodes its argument and POSTs it to https://pumpswap-sdk.maingoal.xyz/v1/check through checkvalidator in dist/index.js, and randomBytessize forwards the hex output of crypto.randomBytes to the same host...

Malicious code in raydium-clmm-sdk (npm)

raydium-clmm-sdk 0.0.1 and 0.0.2 identical dist/index.js present crypto helpers for the Raydium CLMM, but initKeypaircontent base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check through checkvalidator, and randomBytessize forwards the hex output of...

MAL-2026-16085 Malicious code in crypto-validates (npm)

[email protected] ships a dist/index.js identical to [email protected]: validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check through checkvalidator, and randomBytessize forwards freshly generated crypto.randomBytes output to the...

Malicious code in @versacode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fb56d60eb9a1df8a4b6dc87789234366b8431047ca01dbce807af874778ffa8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @haimiya/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb1fac619ba416b14b747307762d4e4cf1cfc41f00a244c8e472af5f689deb0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16066 Malicious code in @haimiya/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb1fac619ba416b14b747307762d4e4cf1cfc41f00a244c8e472af5f689deb0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @vallensofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02adc12975b9798883d78640d5cab1a73420818d23fbd192ebb76a384f056d54 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16068 Malicious code in @versacode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fb56d60eb9a1df8a4b6dc87789234366b8431047ca01dbce807af874778ffa8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in i18nexus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...