CrafterCMS-CVE-2025-6384

CrafterCMS प्रमाणित RCE - Groovy सैंडबॉक्स बाईपास CVE-2025-6384 CrafterCMS में प्रमाणित रिमोट कोड एक्ज़ीक्यूशन भेद्यता के लिए एक प्रूफ ऑफ कॉन्सेप्ट। भेद्यता सारांश डेवलपर विशेषाधिकारों वाला एक प्रमाणित उपयोगकर्ता रिमोट कोड एक्ज़ीक्यूशन RCE प्राप्त करने के लिए Crafter Studio में Groovy स्क्रिप्ट...

CVE-2026-40217-PoC

CVE-2026-40217 — Evasione dalla sandbox di LiteLLM Guardrail LiteLLM POST /guardrails/testcustomcode — Evasione dalla sandbox che porta a Remote Code Execution RCE come root nella distribuzione Docker predefinita. Campo| Valore ---|--- CVE| CVE-2026-40217 CVSS| 8.8 ALTO —...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox

A flaw was found in WebKitGTK. A malicious website can process restricted web content outside the sandbox due to improper input validation, potentially allowing access to resources that should be restricted...

webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox

A flaw was found in WebKitGTK. A malicious website can process restricted web content outside the sandbox due to improper checks, potentially allowing access to resources that should be restricted...

Node_CVE-2023-29017

CVE-2023-29017 | Esecuzione di codice remoto tramite vm2 Sandbox Escape WHS 4기 31반 - 김건우@gunwoo105 Riepilogo della vulnerabilità vm2 è una libreria sandbox Node.js per eseguire JavaScript non affidabile in un ambiente limitato. In condizioni normali, il codice all'interno della sandbox non dovreb...

webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox

A flaw was found in WebKitGTK. A malicious website can process restricted web content outside the sandbox due to improper checks, potentially allowing access to resources that should be restricted...

webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox

A flaw was found in WebKitGTK. A malicious website can process restricted web content outside the sandbox due to improper input validation, potentially allowing access to resources that should be restricted...

Important: Red Hat Security Advisory: webkit2gtk3 security update

An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

Jenkins Script Security Plugin <=1.49 - Sandbox Bypass

A sandbox bypass vulnerability exists in the Jenkins Script Security Plugin versions 1.49 and earlier within src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java. This flaw allows attackers with permission to submit sandboxed scripts to execute arbitrary code on th...

CVE-2022-27665

CVE-2022-27665 Esiste una vulnerabilità di XSS riflesso tramite espressioni di escape della sandbox AngularJS in Progress/IPSwitch WSFTP Server 8.6.0 che può portare all'esecuzione di codice e comandi malevoli sul client a causa di una gestione impropria dell'input fornito dall'utente. Inserendo...

cve-2026-9558-poc

CVE-2026-9558 — Iniezione di template lato server SSTI nei template dei temi di Mautic fino alla compromissione totale dell'admin Indice Panoramica Versioni interessate Causa principale Analisi Struttura del repository Requisiti Utilizzo Output previsto Riferimenti Avvertenze Panoramica...

StepJack

StepJack: Benchmarking della sicurezza degli agenti computer-use contro l'iniezione indiretta di prompt in più passaggi Setup 1. Configurazione dell'ambiente Python Per prima cosa, installa tutte le dipendenze e assicurati di utilizzare Python 3.10. root@kitploit: conda create -n stepjack...

de4dot

Description de4dot is an open source GPLv3 .NET deobfuscator and unpacker written in C. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored eg. string encryption, but symbol renaming is impossible to...

Presentations

Präsentationen Präsentation| Folien| Video ---|---|--- BlueHat IL 2020 - Trinity: PSP Emulator Escape| 2020-BlueHatIL-Trinity.pdf| https://www.youtube.com/watch?v=J0OQsDTyAL8 Hardwear.io USA 2022 - bd-jb: Blu-ray Disc Java Sandbox Escape| 2022-hardwear-io-bd-jb.pdf|...

AgentGuard

AgentGuard Sandbox a fiducia zero per agenti AI autonomi. AgentGuard avvolge qualsiasi agente AI LangChain, CrewAI, AutoGen, script personalizzati con binari di sicurezza. Con un solo cambiamento di comando: root@kitploit: Before dangerous — agent has full system access python myagent.py After...

CVE-2025-68613-n8n-rce-analysis

Matrix GIF...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76839

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by...