RemoteAssistance-Cpp

RemoteAssistance-Cpp RemoteAssistance like TeamViewer C++ version https://dydtjr1128.github.io/RemoteAssistance-Cpp/ It also made java swing version = Link This version is only implemented up to local mirroring, which has not yet used network. ToDo - x Screen capture - x Double buffering - Add...

Keylogger

Inputs To Mail. Get Keyboard,Mouse,ScreenShot,Microphone Inputs and Send to your Mail. Purpose of the project is testing the security of information systems INSTALLATION You don't need to do anything for installation just run the script USAGE •Create an account on "https://mailtrap.io/" using a...

Powershell-RAT

Powershell-RAT Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends the information to an attacker as an e-mail...

0net

0net: semplice backdoor per il controllo remoto di Windows Introduzione: 0net è un semplice programma backdoor per il controllo remoto di Windows. Il client è scritto in C++ e compilato con VC++ 6.0. Il server è scritto in Python e può essere utilizzato su più piattaforme. Il progetto è attualmen...

MAL-2026-13879 Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

MAL-2026-13694 Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

EUVD-2026-54571

In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...

Malicious code in hehehee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc5c7d437f7024811aab8bf68e70fb18366e843a3ee3048dc3dfe628bde5628 Package metadata and README advertise a 'Windows diagnostic utility' / 'high-performance DOM utility', but the actual code main.js is a stealth...

MAL-2026-10428 Malicious code in sysb1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 530efe2fec0ffeabda93aa5e9718161f131bb28d35f28432d5d2c2da6e4763a4 The npm package sysb1 advertises itself as a 'System binary configuration tool' but ships a Windows surveillance agent. index.js declared as both mai...

CVE-2026-13125

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...

CVE-2026-13125

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...

CVE-2026-13125

GeoWebPlayer (GeoVision addon, also called Web Plugin/WS Player) exposes a websocket server with no authentication. Vulnerable component: GeoWebPlayer version 1.1.1.0. Root cause: missing authentication for critical websocket operations, enabling a malicious page to open a connection and issue pr...

GeoVision GeoWebPlayer Websocket Server lack of authentication vulnerability

Summary A lack of authentication vulnerability exists in the Websocket Server functionality of GeoWebPlayer versions: 1.1.1.0. A specially crafted websocket connection can lead to execute priviledged operation. An attacker can stage a malicious webpage to trigger this vulnerability. Confirmed...

CVE-2026-58056

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded...

CVE-2026-58056 RustDesk - FileTransfer Session Authorization Scope Bypass

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded...

EUVD-2026-39976

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded...

MAL-2026-6406 Malicious code in syspo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e90cf048bcfbc5fcc4108def74bee85be749c8f388aa2b93b4281af3808a2a1 Package is published under the cover story 'System binary configuration tool' but its actual behavior is a Windows surveillance dropper. On invocatio...

Malicious code in sypoi1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22a9450e70ba1095097d2779ad6da01c111c37e940d890fbfc21d1aeb6a0f11 On require, index.js silently bootstraps a full Python runtime on the installer's machine — first via winget install -e --id Python.Python.3.12...

MAL-2026-5897 Malicious code in noderzero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fa08be36ae12861809af052871d79536e7ed601c90bb2cff80fa0371e2c4ce noderzero is a self-described 'stealth assistant' that exfiltrates clipboard contents and full-screen screenshots to a hardcoded author-controlled...