Blind-SSRF-to-Remote-Code-Execution-Shellshock-Professional-Bug-Bounty-Report

从盲SSRF到远程代码执行（Shellshock）——专业漏洞赏金报告 此仓库包含一份专业的漏洞赏金报告，演示了成功利用盲SSRF漏洞，该漏洞触及了存在Shellshock（CVE-2014-6271）漏洞的内部CGI端点。通过带外（OAST）DNS回调确认了远程命令执行，展示了完整的攻击链和技术分析。...

MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

MAL-2026-5575 Malicious code in testzapier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5840f2a3b34d7f32de7243a146ecf85ac875bd1ef09b0ba9a395d08e356084f package.json declares a preinstall hook node index.js that fires automatically on npm install. index.js spawns a shell that runs curl -X POST against...

Malicious code in testzapier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5840f2a3b34d7f32de7243a146ecf85ac875bd1ef09b0ba9a395d08e356084f package.json declares a preinstall hook node index.js that fires automatically on npm install. index.js spawns a shell that runs curl -X POST against...