shocker

Shocker A tool to find and exploit servers vulnerable to Shellshock Ref: https://en.wikipedia.org/wiki/Shellshocksoftwarebug Released as open source by NCC Group Plc - https://www.nccgroup.trust/ Developed By: Tom Watson, tom dot watson at nccgroup dot trust https://github.com/nccgroup/shocker...

sqlmc

SQLMC - SQL Injection Massive Checker Demo Information This tool is for educational purpose only, usage of SQLMC for attacking targets without prior mutual consent is illegal. Developers assume no liability and are not responsible for any misuse or damage cause by this program. Overview SQLMC SQL...

CVE-2026-124314

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 are vulnerable to a missing authorization flaw in the erpnext.crm.utils.get_open_activities component. This vulnerability allows any authenticated user, including those with no specific roles or portal access, to perform unauthorized...

EUVD-2026-119268

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to...

extrude

extrude Analyse binaries for missing security features, information disclosure and more. 🚧 Extrude is in the early stages of development, and currently only supports ELF and MachO binaries. PE Windows binaries will be supported soon. Usage Usage: extrude flags file Flags: -a, --all Show details o...

[SECURITY] Fedora 45 Update: zanshin-26.08.2-1.fc45

Zanshin Todo is a powerful yet simple application for managing your day to day actions. It helps you organize and reduce the cognitive pressure of what one has to do in his job and personal life. You'll never forget anything anymore, getting your mind like water...

Malware in @walknpm/todo-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @walknpm/todo-cli (npm)

@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...

MAL-2026-18320 Malicious code in @walknpm/todo-cli (npm)

@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...

Malicious code in @walknpm/todo-cli (npm)

@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...

Malicious Package

Overview @walknpm/todo-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @beloved-lenora/opencode-todo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b77fc053f72d1eaff51ad3b9af235119b5aa1dbb28d216c084e7023d4e963f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @beloved-lenora/opencode-todo

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17909 Malicious code in @beloved-lenora/opencode-todo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b77fc053f72d1eaff51ad3b9af235119b5aa1dbb28d216c084e7023d4e963f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @beloved-lenora/opencode-todo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-114069

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in admin area/index.php that allows attackers to inject HTML via the val parameter in mode=add todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

NETGEAR DGN syscmd RCE (CVE-2024-12847)

Exploits CVE-2024-12847 in NETGEAR DGN routers: unauthenticated command injection via setup.cgi todo=syscmd&cmd= parameter. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847.""" import re import urllib.parse from kittysploit import from...

NETGEAR Debug Auth Bypass (CVE-2020-27866)

Exploits CVE-2020-27866 on multiple NETGEAR routers: unauthenticated access to /setup.cgi?todo=debug exposes debug mode and configuration pages. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR password recovery auth bypass CVE-2020-27866.""" from kittysploit import from...

CVE-2026-90582

A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo Endpoint. Such manipulation of the argument event.body leads to resource consumption. The attack can be executed remotely. The exploit is...

EUVD-2026-77072

A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file src/index.js of the component API Todo Endpoint. Such manipulation of the argument event.body leads to resource consumption. The attack can be executed remotely. The exploit is...