CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

EUVD-2026-51853

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308

Concretely documented CVE-2026-67308 affects Wazuh workflows prior to 44bf114. A shell injection exists in GitHub Actions workflows via fork pull requests that submit crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated in...

CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

CVE-2026-67308: Improper Neutralization of Special Elements used in an OS Command

Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...

PT-2026-67288

Name of the Vulnerable Software and Affected Versions Wazuh workflows versions prior to 44bf114 Description A shell injection issue exists in GitHub Actions where attackers can execute arbitrary commands by submitting pull requests containing crafted VERSION.json files. This occurs because shell...

Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-11424 Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

CVE-2026-53599

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

CVE-2026-53599

CVE-2026-53599 affects REDAXO CMS versions 5.18.2–5.21.1 where rex_mediapool::isAllowedExtension lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg. On servers with multi-extension PHP handlers, this can be executed as the web serve...

CVE-2026-53599

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with mediaupload permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with...

Python DNS Reverse Shell

Poll DNS TXT records for commands and exfil output via result queries stdlib UDP DNS — no dnspython required on target. Pairs with listeners/covert/dns. from kittysploit import from lib.c2.dnsreverseagent import buildpythondnsagentscript class ModulePayload: """DNS TXT polling agent — deliverable...

Python MQTT Reverse Shell

Connect to an MQTT broker, subscribe to cmd topic, publish results stdlib MQTT 3.1.1 — no paho required on target. Pairs with listeners/iot/reversemqttshell. from kittysploit import from lib.c2.mqttreverseagent import buildmqttreverseagentscript class ModulePayload: """MQTT reverse shell agent —...

Python Reverse WebSocket Shell

Connect back over WebSocket and provide an interactive command shell stdlib only from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Python Reverse WebSocket Shell", "description": "Connect back over WebSocket and provide an interactive command she...

Python Reverse TCP (thin / EXE stager)

Minimal Python reverse TCP shell. generate returns a compact one-liner; set compileexe=true to build a Windows EXE via Zig getpythonscript. Designed as a thin stager for exploit chains. from kittysploit import class ModulePayload: """Thin Python reverse TCP payload with optional Zig compile-to-EX...

PowerShell Kitty Agent (typed tasks)

PowerShell HTTP polling agent with typed tasks shell/ls/pwd/whoami/cat/download/upload for listeners/multi/reversehttppolling from kittysploit import import base64 from lib.c2.beaconprofile import BeaconProfile from lib.c2.powershellhttppolling import buildpowershellhttppollingscript class...

PowerShell Command Shell, Reverse HTTPS (TLS)

Connect back over TLS SslStream and create an interactive command shell. No native reversehttps listener — terminate TLS on the operator side stunnel, openssl sserver, etc. and forward plaintext to listeners/multi/reversetcp, or use listeners/multi/reversetls for native TLS termination...