Exploit for CVE-2026-102422

CVE-2026-102422 POC Proof of concept for GHSA-pqg4-j6r4-53mv...

PT-2026-107482

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell quote nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to...

[SECURITY] [DSA 6548-1] node-shell-quote security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 06, 2026 https://www.debian.org/security/faq -...

GHSA-PQG4-J6R4-53MV shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...

EUVD-2026-88629

shell-quote: quote command injection via a line terminator in a token after a comment token...

NPM: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

NPM: shell-quote: quote command injection via a line terminator in a token after a comment token vulnerability discovered by ? in WordPress Npm shell-quote versions = 1.8.4, 1.11.0...

shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token

Impact quote emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator in that later string ends the comment, and the rest of the string is parsed as shell input: js quote'echo', 'ok',...

CVE-2022-3942

CVE-2022-3942 Sanitization Management System におけるクロスサイトスクリプティング 説明: Sanitization Management System v1.0 のクロスサイトスクリプティング（XSS）脆弱性により、潜在的な攻撃者が Request Quote Form の Remarks フィールドまたは Address フィールドに注入した細工済みペイロードを介して、任意のウェブスクリプトまたは HTML を実行できる可能性があります。ログイン済みのスタッフまたは管理者ユーザーがその見積もりを開くとすぐに XSS...

CVE-2026-104040

A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol OData queries. A low-privileged local user can exploit this flaw by submitting a crafted...

Debian dsa-6548 : node-shell-quote - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6548 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6548-1 [email protected] https://www.debian.org/securit...

CVE-2026-9277

CVE-2026-9277 - Shell-Quote 명령 주입 익스플로잇 레거시 shell-quote 라이브러리= 1.8.3에서 발견된 구조적 명령 주입 취약점인 CVE-2026-9277 을 검증 및 시연하기 위해 설계된 특수 PoCProof of Concept 익스플로잇 스크립트입니다. 이 스캐너는 입력 JSON 페이로드에 대해 깊은 구조적 조작을 수행하여 재귀적 순회를 통해 원격 코드 실행RCE 벡터를 노출하며, 동적 네트워크 기준 타이밍 엔진을 사용하여 오탐을 방지합니다. 주요 기능 재귀적 JSON 순회: 다중 레이어 중첩...

CLSA-2026-1791201398 TuxCare security update for shell-quote (2 CVEs)

TuxCare rebuilt shell-quote to address 2 CVEs. Fixed in 1.8.1-tuxcare.2...

Astra Linux – Vulnerability in grub2

A flaw was discovered in grub2 in versions prior to 2.06. The Setparamprefix function in the menu rendering code performs a length calculation based on the assumption that expressing a single quoted character would require 3 characters. However, in reality, it requires 4 characters. This allows a...

CVE-2024-24576-PoC-BatBadBut

CVE-2024-24576-PoC-BatBadBut PoC for CVE-2024-24576 vulnerability "BatBadBut" Information After running the script will ask you for an argument, the argument will be passed the the bat file, if you close the argument with " and after that & you can run any Windows command. For example: helloworld...

attestos

attestos 안티치트 벤더가 배포판 이름 허용 목록에 의존하는 대신 무엇을 검증할 수 있는지 테스트하기 위한 실험적인 Linux 부팅 증명attestation 이미지 및 증거 하네스입니다. 메커니즘, 위협 모델, 벤더 사양은 plunder707/attested-gaming에 있습니다. 이 저장소는 증거를 생성하는 이미지입니다. 상태: 소스 메커니즘 미리보기. 설치 불가, 프로덕션 신뢰 불가. GitHub Actions 실행 31157890393 및 31159951490은 Bazzite 기반 QCOW2를 빌드하고, swtpm...

discourse-CVE-2023-45806

yksivaihde-CVE-2023-45806 CVE: https://github.com/discourse/discourse/security/advisories/GHSA-hcgf-hg2g-mw78 Patch: https://github.com/discourse/discourse/commit/7d484864fe91ff79c478f57e7ddb1235d701921e usage: fixquoteattribution"Username|", , 여기서 "Username|"는 인용문 귀속quote attribution 내의 고유 검색...

CVE-2026-90988

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published...

WordPress Request a Quote plugin <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure vulnerability

Unauthenticated Quote Request Contact Record Disclosure vulnerability discovered by Artus KG in WordPress Plugin Request a Quote versions = 2.5.6...

CVE-2026-90988 Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published...

CVE-2026-90988 Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published...