mc-log4j-patcher

mc-log4j-patcher 古い（脆弱性のある - CVE-2021-44228）Log4j2 バージョンを、JNDI RCE 修正を含む最新版（2.15.0）に置き換えます。 Spigot 1.12.2、PaperSpigot 1.8.8、PaperSpigot 1.17.1 でテスト済みです。 これは現在サポートされていないサーバー（PaperSpigot 1.8.8 など）を修正するためのものです。 このツールを使用する前に、現在のサーバーソフトウェアに脆弱性を修正する公式リリースがあるかどうか確認してください。 使用方法: java -jar patcher.jar...

minecraft-log4j-honeypot

Minecraft Log4j 허니팟 이 허니팟은 공격을 기다리는 가짜 Minecraft 서버1.7.2 - 1.16.5, 스냅샷 제외를 실행합니다. 페이로드 클래스는 payloads/ 디렉토리에 저장됩니다. 요구 사항 Golang 1.16+ 실행 네이티브 git clone https://github.com/Adikso/minecraft-log4j-honeypot.git cd minecraft-log4j-honeypot go build . ./minecraft-log4j-honeypot Docker 사용 mkdir payloads...

CVE-2022-51016 PocketMine-MP 3.x before 3.27.0 Authentication Bypass via Login Replay

PocketMine-MP 3.x before 3.27.0 does not implement Minecraft Bedrock protocol encryption, so the server cannot verify that a connecting client possesses the private key corresponding to its login token. An attacker who captures a valid login from another player's session for example by tricking t...

Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...

MC-271325-DoS-PoC

Log amplification based denial for service for vanilla Minecra...

Rcon-Bruteforce

RCON Scanner & Exploitation Toolkit ⚠️ EDUCATIONAL PURPOSE...

bareiron 安全漏洞

Bareiron is a Minecraft game server developed by the P2R3 individual developer. Bareiron has a security vulnerability, which stems from the existence of arbitrary memory write conditions, potentially allowing unverified attackers to execute arbitrary code...

bareiron 安全漏洞

Bareiron is a Minecraft game server developed by the P2R3 individual developer. Bareiron has a security vulnerability, which stems from excessive memory access. This vulnerability could allow unverified attackers to access sensitive information or cause denial-of-service attacks...

bareiron 安全漏洞

Bareiron is a Minecraft game server developed by the P2R3 individual developer. Bareiron has a security vulnerability, which stems from a buffer overflow. This vulnerability could allow unverified remote attackers to trigger a denial-of-service attack by sending data packets...

Crafty Controller 安全漏洞

Crafty Controller is a Minecraft server control panel/launcher for Arcadia. A security vulnerability exists in Crafty Controller that stems from improper input neutralization of the Webhook Template component, which could lead to remote code execution via server-side template injection...

Crafty Controller 跨站脚本漏洞

Crafty Controller is a Minecraft server control panel/launcher for Arcadia. A cross-site scripting vulnerability exists in Crafty Controller that stems from improper neutralization of inputs to the Server MOTD component, which could lead to a stored cross-site scripting attack by modifying the...

minecraft-server-exploit-finder

minecraft-server-exp...

CVE-2025-61680 Minecraft RCON Terminal: Plain Text Password Storage in Configuration

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0...

EUVD-2024-3108

Malicious code in bioql PyPI...

CVE-2025-54117: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting XSS vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the dashboard text editor component. This vulnerability is fixed ...

CVE-2023-30859

Triton is a Minecraft plugin for Spigot and BungeeCord that helps you translate your Minecraft server. The CustomPayload packet allows you to execute commands on the spigot/bukkit console. When you enable bungee mode in the config it will enable the bungee bridge and the server will begin to...

CVE-2025-27107

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java...

CVE-2025-27107 Integrated Scripting vulnerable to arbitrary code execution via Java reflection

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java...

CVE-2025-27107: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java...

Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to a Denial of Service DoS. The vulnerability exists due to the lack of default limits in the explode function, allowing malicious clients to abuse packets and exhaust server resources...