cacti-rce-cve-2022-46169-vulnerable-application

Aplicación vulnerable de inyección de comandos en Cacti v1.2.22 CVE-2022-46169 Esta es una aplicación vulnerable para probar el exploit de la vulnerabilidad Cacti CVE-2022-46169. ¡ADVERTENCIA! Esta aplicación contiene vulnerabilidades de seguridad graves. ¡Úsela bajo su propio riesgo! Se recomien...

CVE-2022-26134

CVE-2022-26134 - Vulnerabilidad de inyección OGNL. En las versiones afectadas de Confluence Server y Data Center, existe una vulnerabilidad de inyección OGNL que permitiría a un atacante no autenticado ejecutar código arbitrario en una instancia de Confluence Server o Data Center. PoC: git clone...

CVE-2026-92368

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...

CVE-2026-78683

A flaw was found in NLTK. This vulnerability allows arbitrary code execution due to unsafe deserialization, where data loaded from storage is converted back into active objects without adequate restrictions. When the TransitionParser component processes a model file, it fails to enforce safe...

CVE-2022-1388

F5-CVE-2022-1388-Exploit Exploit y Script de Verificación para CVE 2022-1388 Uso bash / | | | || | / | |/ / \ / | | || || | | / /| | | || | ' / /'| |/' |' / /'' / /'| | / / \ V / \ V / | | | | | || ||| / / | /| | / / / / ||| | \ \ / \ / \ | /\ / /| | ./ /\ |/ /./ /./ / | |./ /| || || || | /...

CVE-2025-60751

CVE-2025-60751 PoC para CVE-2025-60751 Producto afectado: Geographiclib = v2.5.1 El artículo completo está disponible en https://zer0matt.blogspot.com/2026/05/cve-2025-60751-geographiclib-stack.html Descripción Se produce un desbordamiento de búfer en la pila cuando GeoConvert recibe una entrada...

EUVD-2026-89021

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...

CVE-2025-3248

POC - Remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code - CVE-2025-3248 Overview Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP request...

jscythe

jscythe 滥用 Node.js 的检查器机制，以强制任何基于 Node.js/Electron/v8 的进程执行任意 JavaScript 代码，即使其调试功能已被禁用。 已在 Visual Studio Code、Discord、任何 Node.js 应用程序等环境中测试并运行！ 使用方法 1. 定位目标进程。 2. 向进程发送 SIGUSR1 信号，这将在某个端口上启用调试器（具体端口取决于软件，有时是随机的，有时是固定的）。 3. 通过对比发送 SIGUSR1 前后的开放端口差异，确定调试端口。 4. 从 http://localhost:/json 获取 WebSocket...

CVE-2020-14882

CVE-2020-14882部署冰蝎内存马 众所周知，CVE-2020-14882是一个未授权漏洞，攻击者可以利用该漏洞在受影响的 WebLogic Server 上执行任意代码。 网上公开的poc中既是通过非法字符绕过访问，然后通过Gadget调用命令执行。那么在实际应用场景和红队攻击中光执行命令是远远不够的，这时候如何通过未授权漏洞进一步利用部署内存马就显得尤为重要。 漏洞分析文章网上一大堆，就是二次编码问题，直接看网上公开的执行代码POC： POST /console/images/%252e%252e/console.portal HTTP/1.1 Host:...

CVE-2019-7609

CVE-2019-7609 Las versiones de Kibana anteriores a 5.6.15 y 6.6.1 contienen una falla de ejecución de código arbitrario en el visualizador Timelion. Un atacante con acceso a la aplicación Timelion podría enviar una solicitud que intente ejecutar código JavaScript. Esto podría llevar a que un...

Malicious code in express-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e4909976d37fb7fb7dd30012d82bd882608df20716a824f1dc0efa074b5401 [email protected] impersonates the express package copying its description, author, contributors, repository, homepage, and dependency list...

Malicious code in express-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aea7dd76028cd443cf2f8d58fa5d8b3b28bb6db870f34d1cc6dad28db92fe93 [email protected] typosquats the express framework: package.json copies express's description, author TJ Holowaychuk, repository expressjs/express...

Malicious code in exprrdd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc1c956097cd13e80298a796a5026ebd91ece7c2ad53d226d3729f0b0b0ee9f3 Package 'exprrdd' copies express's metadata name-lookalike, description, author, contributors, repository, keywords, dependencies as cover for a...

Malicious code in exptred (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d91842ab3e5c93f5689a985b63f8de5455910d88d6815ee35f2d35d27f8a4cf7 npm package [email protected] is a typosquat of express: package.json copies express's description 'Fast, unopinionated, minimalist web framework', autho...

MAL-2026-17247 Malicious code in exptredd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 288357063a28e85e649fc37c747c724bd06ce09c16624f7b2cad3dc854296035 npm package [email protected] impersonates the express package: package.json copies express's description, author, repository, contributors, and...

Malicious code in exptredd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 288357063a28e85e649fc37c747c724bd06ce09c16624f7b2cad3dc854296035 npm package [email protected] impersonates the express package: package.json copies express's description, author, repository, contributors, and...

Malicious code in exprdd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd27ec488e87cd2e26c940ac161033475731708a3f2ae629c4a138275b520f9 [email protected] impersonates the express framework — package name, description, author, contributors, repository, homepage, and keywords are copied...

CVE-2024-0582

RU GenIoURingExploit 是一个针对 Linux 内核特定漏洞 CVE-2024-0582 的 PoC 利用程序。该 PoC 利用 iouring 机制，通过操纵套接字缓冲区并触发某些内核行为，获取未授权访问并可能提升权限。 特性 利用 iouring 实现高效的缓冲区操作。 演示 KASLR（内核地址空间布局随机化）泄漏。 利用与套接字缓冲区管理相关的漏洞。 通过受控的 IOCTL 调用触发利用。 提供通过内核操作执行任意 shell 命令的路径。 前提条件 基于 Linux 的系统（已在最新的发行版上测试）。 访问所需资源的 root 或管理员权限。 用于编译 C...

CVE-2026-102566

CTranslate2 versions prior to 4.8.1 are vulnerable to a heap-based buffer overflow within the binary model loader. The root cause is a failure to validate the payload length against the allocated buffer size when processing model.bin files. An attacker can craft malicious model files with oversiz...