pg_dump Code Execution

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

GHSA-XMJ3-9GF7-H52W vulnerabilities

Vulnerabilities for packages: azure-functions-python-worker...

Apache Superset < 4.0.2 - SQL Injection

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...

Spring Framework Path Traversal in Functional Web Frameworks

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

ShadowClone

ShadowClone ShadowClone allows you to distribute your long running tasks dynamically across thousands of serverless functions and gives you the results within seconds where it would have taken hours to complete. You can make full use of the Free Tiers provided by cloud providers and supercharge...

yarasafe

YARASAFE - Automatic Binary Function Similarity Checks with Yara SAFE is a tool developed to create Binary Functions Embedding developed by Massarelli L., Di Luna G.A., Petroni F., Querzoni L. and Baldoni R. You can use SAFE to create your function embedding to use inside yara rules. If you are...

PoC-CVE-2025-55182

PoC: CVE-2026-33017 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code...

AzureC2Relay

AzureC2Relay AzureC2Relay is an Azure Function that validates and relays Cobalt Strike beacon traffic by verifying the incoming requests based on a Cobalt Strike Malleable C2 profile. Any incoming requests that do not share the profiles user-agent, URI paths, headers, and query parameters, will b...

safe-expr-eval

safe-expr-eval Fast and lightweight expression evaluator for JavaScript and TypeScript. A modern expression parser with a familiar API, zero dependencies, and full TypeScript support. Features Fast expression parsing and evaluation Lightweight and dependency-free Full TypeScript support Simple an...

CVE-2022-34265

CVE-2022-34265 Usage start docker-compose build docker-compose up -d stop docker-compose down PoC verification of Django vulnerability CVE-2022-34265 A vulnerability CVE-2022-34265 in Django was disclosed on July 5, 2022 US time. This article describes our discussion of this vulnerability and the...

CVE-2025-55182

CVE-2025-55182 - React2Shell Pre-authentication RCE in React Server Components. Summary of the CVE A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the react-server-dom-parcel,...

react2shell-scanner

🚨 React2Shell Scanner CVSS 10.0 RCE in React Server Components. Is your React 19 app vulnerable? Fast, accurate scanner for CVE-2025-55182 React2Shell - a critical remote code execution vulnerability exploited in the wild. Zero false positives with intelligent Server Components detection. 🚨 About...

AutoFunkt

AutoFunkt d8888 888 8888888888 888 888 d88888 888 888 888 888 d88P888 888 888 888 888 d88P 888 888 888 888888 .d b. 8888888 888 888 88888b. 888 888 888888 d88P 888 888 888 888 d88 88b 888 888 888 888 "88b 888 .88P 888 d88P 888 888 888 888 888 888 888 888 888 888888K 888 d8888888888 Y88b 888 Y88b...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

hashes

RustCrypto: Hashes !Project Chatchat-imagechat-link !dependency statusdeps-imagedeps-link !Apache2/MIT licensedlicense-image Collection of cryptographic hash functions1 written in pure Rust. All algorithms reside in separate crates and are implemented using traits from digest crate. Usage example...

DVFaaS-Damn-Vulnerable-Functions-as-a-Service

DVFaaS - Damn Vulnerable Functions as a Service A DHIY Deploy and Hack It Yourself Project that you can deploy and run a bunch of 'orribly insecure functions on AWS Lambda Objective and Audiences We at we45 do a lot of training around Serverless Security, Cloud and security of modern web stacks. ...

CVE-2025-55182

CVE-2025-55182 This vulnerability allows RCE in React Server Functions, e.g. as offered by Next.js through insecure prototype references. I'm not an expert in React or Next.js, so take all the information here with a grain of salt. Background React offers Server Functions^1, which can be seen as...

CVE-2026-1208

CVE-2026-1208: Cross-Site Request Forgery in Friendly Functions for Welcart Keywords: CVE-2026-1208, Friendly Functions for Welcart vulnerability, CSRF, Cross-Site Request Forgery, WordPress security, WordPress plugin vulnerability, CWE-352, Welcart security, settings manipulation, WordPress CVE...