35229 matches found
FTP Fetch, Windows Upload/Execute, Reverse TCP Stager
Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule includ...
FTP Fetch, Bind TCP Stager (Linux x86)
Fetch and execute a x86 payload from an FTP server. Listen for a connection Linux x86 Module Options...
Malicious code in llama-tokenizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...
MAL-2026-10163 Malicious code in llama-tokenizer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02 This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads ...
MAL-2026-10139 Malicious code in turbocalc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ae55c7a3030f0ff3493a885460511e83e257b4bd6b3e347136c43518b3bddfa2 During import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial.lu, the exact behaviour is...
Malicious code in turbocalc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ae55c7a3030f0ff3493a885460511e83e257b4bd6b3e347136c43518b3bddfa2 During import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial.lu, the exact behaviour is...
CVE-2026-54001
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to...
CVE-2026-54001 osquery: Heap buffer overflow via `authenticode` table (Windows)
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the authenticode table targeting a maliciously crafted binary, due to...
DNP3 integrity poll
Performs read-only DNP3 integrity-style polls: device attributes, binary inputs, binary output status, and analog inputs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import...
DNP3 read points (legacy path)
Read binary and analog input points from a DNP3 outstation using group 1 and group 30 object reads. Requires prior dnp3identify. !/usr/bin/env python3 -- coding: utf-8 -- """ DNP3 read points — analog/binary input enumeration. Solidifies the DNP3 client readpoints path for post-recon data...
Windows External Tool Runner
Upload a local binary or script to the target, execute it with operator-supplied arguments, and optionally download a remote output file. !/usr/bin/env python3 -- coding: utf-8 -- """ Upload a local operator tool to the target, execute it, and optionally pull an output artifact back through the...
PHP WebSocket Mimic Transform
Wraps C2 bytes in WebSocket-like binary frames and emits PHP client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PHP WebSocket...
PowerShell WebSocket Mimic Transform
Wraps C2 bytes in WebSocket-like binary frames and emits PowerShell client code. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from modules.transforms.python.protocol.websocketmimic import Module as PythonWebSocketTransform class ModulePythonWebSocketTransform: """PowerShe...
CVE-2026-59725
A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. An unauthenticated attacker can exploit this vulnerability by sending invalid binary POST requests with a Content-Type of application/octet-stream. This improper handling of requests prevents the HTTP...
socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests
A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. An unauthenticated attacker can exploit this vulnerability by sending invalid binary POST requests with a Content-Type of application/octet-stream. This improper handling of requests prevents the HTTP...
EulerOS 2.0 SP12 : util-linux (EulerOS-SA-2026-2635)
According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check- Time-of-Use vulnerability has been...
Malicious code in @equansservices/setup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b071598889a04c74a8398157555ccfffda5bbc713429df4cafbcf48df7f811af package.json declares a postinstall hook node setup.js that fires automatically on npm install. setup.js selects a platform-specific target and fetch...
`CHECK`-failures in binary ops in Tensorflow
ImpactA malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer matches the dtype expected by the op. In that case...
PYSEC-2026-3191 `CHECK`-failures in binary ops in Tensorflow
Impact A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer matches the dtype expected by the op. In that cas...
CVE-2026-12116 CVE-2026-12116
A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed...