HMAC_Bruteforcer

HMACBruteforcer Very Slow HMAC Key Bruteforcer Implemented in Bash Uses: OpenSSL Crunch Optional...

PT-2026-134181

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "$FTL PID" : "^:digit:", but this rejects only values whose...

CVE-2026-119335: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, advanced/Scripts/utils.sh getFTLPID attempts to validate the pihole-owned /run/pihole-FTL.pid file with expr "$FTLPID" : "^:digit:", but this rejects only values whose...

CVE-2026-1281-CVE-2026-1340-Ivanti-EPMM-RCE

Ivanti EPMM pre-auth RCE Dummy Target A simple demo application that shows how to reproduce the Ivanti EPMM pre-auth RCE vulnerability CVE-2026-1281 / CVE-2026-1340 for educational and security research purposes. Vulnerability Overview This vulnerability exploits Bash arithmetic expansion behavio...

BIT-VIRTUALENV-2026-115586 virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...

BIT-VIRTUALENV-2026-113776 virtualenv activation scripts run code from a path that contains a placeholder name

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

BIT-VIRTUALENV-2026-113725 virtualenv bash activate runs commands from an environment name with a backslash before $

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

BIT-VIRTUALENV-2026-113723 virtualenv: Bash prompt values can change meaning under older compatibility modes

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

CVE-2026-118905

Node Version Manager nvm is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, "nvmls" filters installed versions with a sed program that embeds the requested version pattern in a "..." address, escaping "." and, since 0.40.4, "" but not...

Chimay-Red

Chimay-Red Reverse engineering of Mikrotik exploit from Vault 7 CIA Leaks See the PDF for more info not updated Vulnerable versions Until RouterOS 6.38.4 What's new in 6.38.5 2017-Mar-09 11:32: ! www - fixed http server vulnerability; Proof of concepts CrashPOC Simple crash sending -1 as...

PT-2026-132505

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...

PT-2026-132504

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate template replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUAL NAME , VIRTUAL ENV , or VIRTUAL PROMPT...

PT-2026-132499

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the environment and dr...

PT-2026-132501

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash activate script escapes the environment name for only one of the two passes bash makes over PS1, so a backslash in the name undoes the escaping and a name containing $... runs as commands in the...

PT-2026-132502

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH VERSION is set, so zsh...

bash-shellshock

bash-shellshock Cookbook This cookbook is designed to test and optionally remediate the bash "shellshock" bug, more formally known as cve-2014-7169. Once Chef-client has executed this recipe on one or more hosts, a list of all nodes that are vulnerable to the "Shellshock" exploit can be retrieved...

bash-CVE-2017-17562

bash-CVE-2017-17562 An PoC implementation in Bash for CVE-2017-17562. Requires curl for crafting HTTP requests. Based on Metasploit and @fssecur3 implementations. Arguments The following arguments need to be set as they are required for reconnaissance + payload send: $1: IP/Host of remote...

Shellshock-Vulnerability-Scan

Shellshock-Vulnerability-Scan Android app to scan for bash Vulnerability - CVE-2014-6271 also known as Shellshock Download app from play store https://play.google.com/store/apps/details?id=in.indiandragon.shellshock.shellshockvulnerabilityscan Not being developed further...

StegoCracker

Stegocracker !GitHub Repo starshttps://img.shields.io/g...

SUSE CVE-2026-115586

virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation...