CVE-2025-67733

RESP प्रोटोकॉल इंजेक्शन पीओसी Valkey/Redis में Lua स्क्रिप्ट त्रुटि संदेशों के माध्यम से RESP प्रोटोकॉल इंजेक्शन भेद्यता प्रदर्शित करने वाला प्रूफ-ऑफ-कॉन्सेप्ट। फ़ाइलें backend.py Flask बैकएंड जो साझा Valkey कनेक्शन कनेक्शन पूलिंग के साथ एक वेब एप्लिकेशन का अनुकरण करता है। एंडपॉइंट्स:...

CVE-2020-13151

CVE-2020-13151 POC تنفيذ أوامر على المضيف في قاعدة بيانات Aerospike 5.1.0.3 الشرح الكامل @ https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html يُظهر poc.lua الاستغلال اليدوي للخادم cve2020-13151.py للاستغلال الآلي يُنشئ run-poc.sh بيئة docker للتجارب المحلية...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 प्रमाणित RCE FuguHub एक क्लाउड मीडिया सर्वर सॉफ्टवेयर है। परीक्षण किया गया संस्करण इस लिंक पर उपलब्ध डेबियन संस्करण था: https://fuguhub.com/articles/FuguHub-for-Debian Real Time Logic LLC FuguHub v.8.4 में एक समस्या किसी स्थानीय हमलावर को व्यवस्थापक पैनल के About पृष्ठ पर तैयार की गई...

nginx-mitigate-log4shell

nginx-mitigate-log4shell التخفيف من هجمات ثغرة log4shell CVE-2021-44228 و CVE-2021-45046 باستخدام سكريبت Nginx LUA يتطلب تفعيل وحدة Nginx lua https://www.nginx.com/resources/wiki/modules/lua/. استخدم include /path/to/mitigate-log4shell.conf; في سياق server .... يمكن تضمينه في سياقات server متعددة...

CVE-2022-37932

Уязвимость обхода аутентификации в прошивке коммутаторов HP CVE-2022-37932 Версия прошивки: PD.02.21 Затронутые устройства: HP 1920 Series Smart Managed Switches Обзор В этом репозитории документируется критическая уязвимость обхода аутентификации в коммутаторах HP 1920 Series Smart Managed...

CVE-2025-49844

CVE-2025-49844 الأصل uv POC: https://github.com/saneki/cve-2025-49844 PoC يوفر شل عكسي. قبل البدء pip3 install -r requirements.txt المساعدة python3 CVE-2025-49844.py -h root@kitploit: usage: CVE-2025-49844.py -h -H HOST -P PORT -a PASSWORD -l HOST -p PORT CVE-2025-49844 إثبات المفهوم — Redis 8.2....

protectimus-slim-proxmark3

Protectimus SLIM NFC के लिए Proxmark3 Lua स्क्रिप्ट Proxmark3 RFID प्लेटफ़ॉर्म के लिए यह Lua स्क्रिप्ट समय-आधारित एक-बार पासवर्ड TOTP हार्डवेयर टोकन Protectimus SLIM NFC के साथ इंटरैक्ट करने की अनुमति देती है। हार्डवेयर आवश्यकताएँ Proxmark3 सॉफ़्टवेयर आवश्यकताएँ RRG / Iceman - Proxmark3 डेमो यह...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

CVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

EUVD-2026-53308

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

GHSA-MM6C-5J6X-HQ8M Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Summary Algernon selects its file handler from filepath.Ext engine/handlers.go:134, which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives it...

CVE-2025-67862

An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability CWE-1244 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiPro...

Fortinet FortiOS和Fortinet FortiProxy 安全漏洞

Fortinet FortiOS and Fortinet FortiProxy are products of the American company Fortinet. Fortinet FortiOS is a security operating system specifically designed for the FortiGate network security platform. This system provides users with various security features, including firewalls, antivirus...

JLSEC-2026-556

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. A specially crafted Lua script executed in Redis can trigger a heap overflow in the cjson library, leading to heap corruption and potentially remote code execution. This issue exists in all versions of Redis that support Lua scripting,...

Astra Linux – Vulnerability in Apache2

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a Lua script that calls r:parsebody0 may cause a denial of service due to the lack of a default limit on the possible input size...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A authenticated user may use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution. This issue has been fixed in versions 7.4.2, 7.2.7, and 6.2.17. An additional...

CLSA-2026-1778845249 redis: Fix of 2 CVEs

CVE-2026-23631: fix use-after-free in readSyncBulkPayload when fullsync happens while a Lua script is timed out on the replica - CVE-2026-25243: fix invalid memory access in RESTORE on crafted zipmap, listpack and stream PEL payloads...

CVE-2026-42214 Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which...