Cuteit

Cuteit IP混淆器，旨在让恶意IP地址变得稍微可爱一点 😄 一个简单的Python工具，帮助您进行社会工程、绕过白名单防火墙、可能破坏命令行日志中查找IP地址的正则规则，并对payload中的明文字符串进行混淆，以隐藏到C2服务器的位置。 这一切都通过将IP地址混淆成多种形式来实现。 用法 usage: Cuteit.py -h --disable-coloring ip positional arguments: ip IP you want to convert optional arguments: -h, --help show this help message and...

CVE-2025-13780

CVE-2025-13780：pgAdmin 4 = 8.14 RCE 扫描器 针对 CVE-2025-13780 的全面漏洞扫描器，该漏洞是 pgAdmin 4 版本 ≤ 8.14 中的一个远程代码执行 RCE 漏洞。 🔍 漏洞详情 该漏洞存在于 pgAdmin 4 的 恢复 功能中。应用程序尝试使用正则表达式阻止危险 shell 命令（以 \ 开头）。但是，此检查可以被绕过。 易受攻击的正则表达式 ：^|\n \t\ 绕过方法 ： 1. UTF-8 BOM ：预置 \xef\xbb\xbf 可使正则表达式匹配失败 2. CRLF 注入 ：在反斜杠前使用 \n\r 而不是 \n 📦 安...

THM-Steel_Mountain-CVE-2014-6287

THM-SteelMountain-CVE-2014-6287 关于 TryHackMe.com 上 Steel Mountain 靶机的 write-up 以及 CVE-2014-6287 的利用程序 致谢 我本人对最初发现和利用此漏洞不持任何功劳。感谢以下人员！ 发现者： Daniele Linguaglossa Metasploit 模块作者： Muhamad Fadzil Ramli TryHackMe 房间及作者： https://tryhackme.com/room/steelmountain https://tryhackme.com/p/tryhackme 参考资料：...

CVE-2025-60423

Bypass de autenticación: 7.2.8 Este bypass de autenticación es similar al bypass de permisos de Shiro. En el método dofilterInternal de la clase sessionfilter, el parámetro dofilter es true por defecto, y solo cuando es false se puede evitar la autenticación. Siguiendo hasta el método matches, se...

PT-2026-105478

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

DEBIAN-CVE-2026-100698

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

EUVD-2026-87671

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

CVE-2026-100698 Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the hostport function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returni...

CVE-2026-5524-PoC

CVE-2026-5524 — Divi Form Builder Unauthenticated RCE Mass exploit toolkit for CVE-2026-5524 , an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Divi Form Builder = 5.1.8 leading to remote code execution. Field| Value ---|--- CVE| 2026-5524 CVSS| 9.8 Critical Vector|...

CVE-2026-47780

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

EUVD-2026-78766

free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...

PYSEC-2026-3886 PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

CVE-2026-85788 Incomplete list of disallowed inputs in awslabs mysql-mcp-server

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

USN-8675-2: Perl vulnerabilities

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS. Original advisory details: It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an...

USN-8675-2 perl vulnerabilities

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS. Original advisory details: It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an...

EUVD-2026-69241

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator...

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

Summary An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType's publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a valid literal slips past it and is emitted verbatim into the declaration, so the markup after...

EUVD-2026-58725

CKAN MCP Server: MQA server allowlist bypass via unanchored regex isValidMqaServer...

SUSE CVE-2026-83618

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteralmatch and SystemLiteralmatch expressions produced by...

Linux Distros Unpatched Vulnerability : CVE-2026-83609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in...