CVE-2025-49844

CVE-2025-49844 Original uv POC: https://github.com/saneki/cve-2025-49844 PoC que fornece shell reverso. Antes de Começar pip3 install -r requirements.txt Ajuda python3 CVE-2025-49844.py -h root@kitploit: usage: CVE-2025-49844.py -h -H HOST -P PORT -a PASSWORD -l HOST -p PORT CVE-2025-49844...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 RCE Autenticado Fuguhub é um software de servidor de mídia em nuvem. A versão testada foi a versão Debian neste link: https://fuguhub.com/articles/FuguHub-for-Debian Um problema no Real Time Logic LLC FuguHub v.8.4 permite que um atacante local execute código arbitrário através de um...

CVE-2020-13151

CVE-2020-13151 POC Execução de Comando no Host do Aerospike Database 5.1.0.3 Artigo completo em @ https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html poc.lua mostra a exploração manual do servidor cve2020-13151.py para exploração automatizada run-poc.sh configura...

CVE-2022-37932

Vulnerabilidade de Bypass de Autenticação no Firmware do Switch HP CVE-2022-37932 Versão do Firmware: PD.02.21 Dispositivos Afetados: Switches Gerenciáveis Inteligentes da Série HP 1920 Visão Geral Este repositório documenta uma vulnerabilidade crítica de bypass de autenticação nos Switches...

CVE-2025-67733

RESP प्रोटोकॉल इंजेक्शन पीओसी Valkey/Redis में Lua स्क्रिप्ट त्रुटि संदेशों के माध्यम से RESP प्रोटोकॉल इंजेक्शन भेद्यता प्रदर्शित करने वाला प्रूफ-ऑफ-कॉन्सेप्ट। फ़ाइलें backend.py Flask बैकएंड जो साझा Valkey कनेक्शन कनेक्शन पूलिंग के साथ एक वेब एप्लिकेशन का अनुकरण करता है। एंडपॉइंट्स:...

nginx-mitigate-log4shell

nginx-mitigate-log4shell Mitigar ataques de vulnerabilidade log4shell CVE-2021-44228 e CVE-2021-45046 usando script LUA do Nginx Requer que o módulo lua do Nginx https://www.nginx.com/resources/wiki/modules/lua/ esteja habilitado. Use include /path/to/mitigate-log4shell.conf; no contexto server...

protectimus-slim-proxmark3

Protectimus SLIM NFC के लिए Proxmark3 Lua स्क्रिप्ट Proxmark3 RFID प्लेटफ़ॉर्म के लिए यह Lua स्क्रिप्ट समय-आधारित एक-बार पासवर्ड TOTP हार्डवेयर टोकन Protectimus SLIM NFC के साथ इंटरैक्ट करने की अनुमति देती है। हार्डवेयर आवश्यकताएँ Proxmark3 सॉफ़्टवेयर आवश्यकताएँ RRG / Iceman - Proxmark3 डेमो यह...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

CVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

EUVD-2026-53308

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

GHSA-MM6C-5J6X-HQ8M Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Summary Algernon selects its file handler from filepath.Ext engine/handlers.go:134, which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives it...

CVE-2025-67862

An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability CWE-1244 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiPro...

Fortinet FortiOS和Fortinet FortiProxy 安全漏洞

Fortinet FortiOS and Fortinet FortiProxy are products of the American company Fortinet. Fortinet FortiOS is a security operating system specifically designed for the FortiGate network security platform. This system provides users with various security features, including firewalls, antivirus...

JLSEC-2026-556

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. A specially crafted Lua script executed in Redis can trigger a heap overflow in the cjson library, leading to heap corruption and potentially remote code execution. This issue exists in all versions of Redis that support Lua scripting,...

Astra Linux – Vulnerability in Apache2

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a Lua script that calls r:parsebody0 may cause a denial of service due to the lack of a default limit on the possible input size...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A authenticated user may use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution. This issue has been fixed in versions 7.4.2, 7.2.7, and 6.2.17. An additional...

CLSA-2026-1778845249 redis: Fix of 2 CVEs

CVE-2026-23631: fix use-after-free in readSyncBulkPayload when fullsync happens while a Lua script is timed out on the replica - CVE-2026-25243: fix invalid memory access in RESTORE on crafted zipmap, listpack and stream PEL payloads...

CVE-2026-42214 Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which...