sh4d0wup

sh4d0wup root@kitploit: % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low...

WPS-CVE-2022-24934

ウクライナと連帯 プーチンは犯罪者だ！ 警告 このプログラムはGo 1.18で導入されたGenericsを使用しています。コンパイラをアップグレードしてください！ CVE-2022-24934 wpsupdate.exeを利用して本脆弱性を悪用するWebサーバー 偽のWPSアップデートサーバー PoC 研究目的のみ。 ファイルのダウンロード クライアントに送信するファイルを環境変数として設定: HACKWPSFILENAME この悪意のあるファイルは、Kingsoftのオリジナル署名済み実行可能ファイルを使用して「SigThief-ed」する必要があります。...

sjcam

Lelouch: SJCAM SJ4000 固件研究与自定义固件 Trocar para Português Brasil 针对 SJCAM SJ4000 Air 的 Allwinner V3 版本的逆向工程笔记、固件工具、概念验证代码以及自定义固件界面。 研究文章 本仓库包含研究过程中产生的代码和成果。完整文章阐述了从首次固件转储到 Lelouch 自定义固件的整个调查过程。 阅读完整的研究文章（英文） 或 葡萄牙语版。 关于项目 这项工作始于一个简单的问题：在没有文档、源代码或供应商支持的情况下，我能对一台廉价运动相机获得多少控制权？ 结果发现该相机使用了 Allwinner V3...

eclipse__hawkbit_CVE-2020-27219_0-3-0M6

Eclipse hawkBit™ - 更新服务器 Eclipse hawkBit 是一个领域无关的后端解决方案，用于向受限的边缘设备以及连接在基于 IP 的网络基础设施上的更强大的控制器和网关推送软件更新。 构建: Docker: 文档 参见 hawkBit 文档 联系我们 想与 hawkBit 背后的团队聊天？ 遇到 hawkBit 问题？请提交一个 GitHub issue。 您也可以查看我们的项目主页以获取更多联系方式。 示例与扩展 除了此处托管的 hawkBit 核心之外，该项目还维护着示例和扩展仓库。 hawkBit 沙盒 我们提供一个可免费供所有人试用 hawkBit...

WPS-CVE-2022-24934

警告 该程序使用了 Go 1.18 中引入的泛型，请升级你的编译器！ CVE-2022-24934 通过利用 wpsupdate.exe 来利用此漏洞的 Web 服务器 伪造 WPS 更新服务器 PoC 仅用于研究目的。 下载文件 将你要发送给客户端的文件设置为环境变量：HACKWPSFILENAME 该恶意文件应使用金山原始签名的可执行文件进行“SigThief-ed”处理。 HTTP 服务器将运行在 80 端口。然后运行该程序。 由于恶意文件校验和由客户端请求，如果你更改了文件，你应该重启服务器。 构建 许可证 我们不对非法使用承担任何责任。 你不允许将其用于任何非法目的。 GNU...

CVE-2022-24934

CVE-2022-24934 漏洞概述 WPS Office的更新程序wpsupdate.exe从注册表HKEYCURRENTUSER中读取自定义的更新服务器地址，下载自定义的更新程序并执行，导致任意代码执行。 影响范围 WPS Office版本小于或等于11.2.0.10382均存在该漏洞。 （WPS版本号看最后一组，最后一组数字大即为新版本，11.1表示个人版，11.2表示企业版，11.6和11.8表示政企定制版） 复现环境 操作系统：Win7 sp1。 WPS Office版本：WPS 2019 v11.8.2.10229。 分析工具：Detect It...

CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73533

CVE-2026-73533 affects Ninja Tables Pro 5.2.11. The vulnerability is an embedded malicious code issue introduced via a tampered plugin build served through a decommissioned update server. A rogue file, app/Library/updater/NinjaTableDataSync.php, creates a backdoor REST API endpoint and drops pers...

EUVD-2026-54200

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032 Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032

CVE-2026-17032 concerns Supsystic Multiple Pro Plugins. The issue arises from a vendor update server compromise, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and sensitive data and grants full control of affected sites. The records indicate a cr...

CVE-2026-12375 Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator sessio...

CVE-2026-10735

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

EUVD-2026-38693

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

CVE-2026-10735 ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

CVE-2026-10735

CVE-2026-10735 concerns a supply‑chain compromise of ShapedPlugin Pro plugins (Product Slider Pro for WooCommerce, Real Testimonials Pro, Smart Post Show Pro) delivered via the vendor update server. Technical details show a stage 1 loader in src/Includes/LicenseLoader.php that runs on admin init ...

CVE-2026-12047

CVE-2026-12047 – pgAdmin 4 : HTML injection in the cloud deployment module arises when unsanitised exception text (from verify_credentials, deploy, and related endpoints under /rds/, /azure/, /google/, and /cloud/) is echoed into JSON response fields (info/errormsg) and rendered by the Cloud Wiza...

📄 SumatraPDF 3.5.2 Remote Code Execution

SumatraPDF versions 3.5.0 to 3.5.2 disable TLS hostname verification during update checks using INTERNETFLAGIGNORECERTCNINVALID and do not perform any signature or integrity validation on the downloaded installer. Exploit Title: SumatraPDF 3.5.2 - Remote Code Execution Date: 2026-02-10 Exploit...

electerm has Command Injection via runLinux funtion

Impact What kind of vulnerability is it? Who is impacted? Command Injection vulnerabilities in electerm: A command injection vulnerability exists in github.com/elcterm/electerm/npm/install.js:130. The runLinux function appends attacker-controlled remote version strings directly into an exec"rm -r...