HomePWN

HomePwn - 物联网设备渗透测试的瑞士军刀 . | | \ \ | | \ / \ / / | /\ / / / \ | Y Y Y \ /| | \ / | \ || //||| /\ | //|| / / / / / ☠ HomePwn - 物联网渗透测试与道德黑客 ☠ ♥ 由 'Ideas Locas CDO Telefonica' 团队倾情打造 HomePwn...

IoT-Home-Guard

第一版硬件工具使用Raspberry Pi作为开发平台。用户需要通过ssh登录到Raspberry Pi来启动软件工具，然后将待测试的IoT设备连接到Raspberry Pi的WiFi。 我正在设计第二个版本，用户只需将硬件工具连接到电脑或手机，即可方便地操作。...

CVE-2018-10562

CVE-2018-10562 CVE-2018-10562 漏洞利用 关于 GPON 家庭路由器上的 RCE CVE-2018-10561:认证绕过 CVE-2018-10562:命令注入 所需依赖 requests urllib2 ssl re 截图...

CVE-2020-27199

CVE-2020-27199 Magic Home Pro - 认证绕过 在 Magic Home Pro 移动应用中发现多个漏洞，该应用用于与 JadeHomic LED Strip RGB 套件交互。其中最严重的漏洞是认证绕过漏洞 CVE-2020-27199，该漏洞最终允许完全接管和控制受害者的整个设备组。 以下详细介绍了导致最终利用的枚举步骤，以及用于实施枚举和最终利用的 PoC 材料。 PoC 文件 magichome-forge.py - JWT 伪造器，用于自动化设备接管 magichome-sniffer.py -...

CVE-2026-82932

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

CVE-2026-82929

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

EUVD-2026-88234

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in...

EUVD-2026-88232

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

EUVD-2026-88231

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

EUVD-2026-88230

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

EUVD-2026-88228

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 多个存储型XSS 作者：Sergio 描述： Rite CMS 3.0 受多个跨站脚本（XSS）存储型漏洞影响，攻击者可通过在管理菜单的首页字段中精心构造载荷来执行任意代码。该载荷将在主页面中执行，与用户会话无关，因此其他用户访问主页时也会执行该载荷。 攻击向量： AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L POC： 登录面板后，我们进入"管理 - 首页"部分，或者创建一个新页面并添加载荷。 我们编辑正文配置，在其中添加XSS载荷。由于有多个字段且只有警告输出不同，我指出其中一个载荷： XSS载荷： '"...

CVE-2026-4255

CVE-2026-4255 Thermalright TR-VISION HOME DLL 侧加载特权提升漏洞 严重性: 高 CVSS 8.4 CWE: CWE-829 包含来自不受信任控制域的功能 发布时间: 2026年3月16日 CNA: Toreon 受影响版本: Thermalright TR-VISION HOME ≤ 2.0.5 Windows 64位 发现者: Ard33 描述 Thermalright TR-VISION HOME 使用默认的 Windows DLL 搜索顺序加载 Ftd2xx.dll（FTDI...

Home Assistant HACS - Local File Inclusion

Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration. id: CVE-2021-3152 info: name: Home Assistant HACS - Local File Inclusion...

ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

CVE-2022-36162

CVE-2022-36162 Descripción sugerida pdftoroff hovacui 1.1.0 está afectado por: Ejecución de comandos. El impacto es: ejecutar código arbitrario local. El componente es: hovacui.c, línea 1574. El vector de ataque es: Para explotar la vulnerabilidad, solo tienes que cambiar la variable de entorno...

CVE-2025-66024

CVE-2025-66024: La página de inicio de la aplicación Blog de XWiki es vulnerable a XSS almacenado a través del título de la publicación Resumen Campo| Detalles ---|--- ID de CVE| CVE-2025-66024 Gravedad| ALTA Aviso| Ver aviso Descubierto por| Lukasz Rybak Productos afectados...

CVE-2020-8250

CVE-2020-8250: Privilege Escalation via Command Injection in Pulse Secure VPN Linux Client The root SUID executable pulsesvc, has a function “doupload” that unsafely passes the “HOME” environmental variable to “system”. By altering the “HOME” variable to contain special shell characters Ex: “” or...