polyshell

PolyShell: a Bash/Batch/PowerShell polyglot What It Is PolyShell is a script that's simultaneously valid in Bash, Windows Batch, and PowerShell i.e. a polyglot. This makes PolyShell a useful template for penetration testing as it can be executed on most systems without the need for target-specifi...

polyshell

PolyShell: Bash/Batch/PowerShell 폴리글랏 설명 PolyShell은 Bash, Windows Batch 및 PowerShell에서 동시에 유효한 스크립트입니다 즉, 폴리글랏. 따라서 PolyShell은 대상별 페이로드 없이 대부분의 시스템에서 실행될 수 있어 침투 테스트에 유용한 템플릿입니다. 또한 PolyShell은 USB Rubby Ducky, MalDuino, 또는 유사한 장치를 통한 입력 주입injection으로 전달 가능하도록 특별히 설계되었습니다. 사용 방법 독립 실행 스크립트로 사용 1...

CVE-2021-40303

CVE-2021-40303 perfex crm 1.10은 /clients/profile을 통해 저장형 크로스 사이트 스크립팅XSS에 취약합니다. poc: POST /clients/profile HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8...

Rocky Linux 10.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc (crlsa-2026_29980)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202629980 advisory. net/textproto: golang: Golang net/textproto: Misleading error messages via input injection CVE-2026-42507 Bug Fixes and Enhancements: Update Go to version...

CVE-2018-7600-PoC

SAWPOC — CVE-2018-7600 CVE-2018-7600 （別名 Drupalgeddon2 ）向けの Python 製 Proof of Concept です。 CVE-2018-7600 は、Drupal 7 の特定バージョンに影響を及ぼす重大な脆弱性です。脆弱な構成では、認証されていない攻撃者が悪意のある入力を注入し、リモートコード実行を達成できる可能性があります。 ⚠️ 免責事項: このプロジェクトは、教育目的、CTF、セキュリティ研究、および許可を得たペネトレーションテストにのみ使用することを目的としています。明示的な許可なくシステムに対して使用しないでください。...

PT-2026-98306

Three critical unauthenticated CVEs in ViewSonic vCast CVE-2026-82987, CVE-2026-82988, CVE-2026-82989 allow a remote attacker to chain screen exfiltration with arbitrary APK installation for full device compromise. These are Android-based ViewBoard smartboards, heavily deployed in enterprise and...

PT-2026-98307

Three critical unauthenticated CVEs in ViewSonic vCast CVE-2026-82987, CVE-2026-82988, CVE-2026-82989 allow a remote attacker to chain screen exfiltration with arbitrary APK installation for full device compromise. These are Android-based ViewBoard smartboards, heavily deployed in enterprise and...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

CVE-2026-44766

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

EUVD-2026-72573

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

PT-2026-86948

SAP S/4HANA Intercompany Matching and Reconciliation allows a low-privileged authenticated user to inject malicious input into certain functions, which may be processed by the database without proper validation. This could allow the user to access sensitive information, resulting in high impact o...

The vulnerability of the input-remapper.service service, a device management tool for input devices, allows a malicious actor to switch the service to a specified configuration directory and initiate an injection mechanism for input data.

The vulnerability of the input-remapper.service service, a device management tool for input devices, is related to the lack of authentication. Exploiting this vulnerability allows an attacker to switch the service to a specified configuration directory and activate the mechanism for injecting...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

GHSA-Q7M3-RHXG-7VXR n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

CVE-2026-16926 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input...

PT-2026-76824

Name of the Vulnerable Software and Affected Versions MLflow versions 3.13.0 through 3.14.x Description When deployed with the built-in basic-auth plugin, an authenticated user can inject arbitrary dataset records into another user's run. This occurs because the LogInputs proto handler is missing...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...