Malicious code in mfacord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e On require'mfacord', index.js loads lib/cache.js, which on win32 decodes a hardcoded URL...

Alternative-Approach-Reverse-Shell-Callback-Test-InvokeAI-RCE

Alternative-Approach-Reverse-Shell-Callback-Test-InvokeAI-RCE Approccio Alternativo: Reverse Shell e Test del Callback Panoramica Questo repository contiene approcci alternativi di payload per la vulnerabilità RCE di InvokeAI CVE-2024-12029 quando l'iniezione della chiave SSH fallisce. I payload...

CVE-2020-26217-XStream

CVE-2020-26217 XStream RCE Exploit Strumento di sfruttamento della vulnerabilità di esecuzione di codice remoto in XStream. Descrizione della vulnerabilità CVE-2020-26217 è una vulnerabilità di deserializzazione nella libreria XStream che consente a un attaccante di attivare l'esecuzione di codic...

CVE-2022-1329-WordPress-Elementor-RCE

CVE-2022-1329-WordPress-Elementor-RCE Questa poc è basata su quella di AkuCyberSec. Versione cinese Utilizzo Usa docker-compose per avviare l'ambiente vulnerabile: root@kitploit: docker-compose up -d Quindi puoi accedere alla pagina Admin di WordPress tramite l'URL http://localhost:8000. Registra...

CVE-2017-3881-exploit-cisco-

Una vulnerabilità nel codice di elaborazione del Cisco Cluster Management Protocol CMP in Cisco IOS e Cisco IOS XE Software potrebbe consentire a un attaccante remoto non autenticato di causare un riavvio di un dispositivo interessato o di eseguire codice da remoto con privilegi elevati. Il Clust...

EUVD-2026-67941

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message,...

EUVD-2026-67944

A pre-authentication stack-based buffer overflow vulnerability exists in the httpgdprdecrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface c...

EUVD-2026-67956

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint...

EUVD-2026-67952

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

VulnCheck KEV: CVE-2026-0768

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code...

PT-2026-83429

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...

CVE-2025-24016

Wazuh Remote Code Execution RCE - PoC Überblick über die Schwachstelle Dieses Repository demonstriert die Remote-Code-Execution-Schwachstelle RCE im Wazuh-Server, die durch eine unsichere Deserialisierung im Paket wazuh-manager eingeführt wird. Die Schwachstelle ermöglicht es entfernten Angreifer...

chall.stypr.com

chall.stypr.com شكرًا لك على لعب chall.stypr.com لقد مرت تسع سنوات منذ أن أنشأت واستضفت لعبة الحرب الخاصة بي في البداية. لقد أعادت العديد من مسابقات CTF بالفعل استخدام تحديات مماثلة أو صنعها، لذا قررت مشاركة الكود المصدري لجميع التحديات والإعدادات المستخدمة لاستضافة البنية التحتية للتحدي. البنية...

lab-cve-2025-57819

Lavori in corso FreePBX CVE-2025-57819 Lab - SQLi non autenticata → Catena RCE Nuclei POC Avvia un laboratorio FreePBX 15 riproducibile Docker per validare CVE-2025-57819 — una critica SQL injection non autenticata negli endpoint AJAX di userman che può essere concatenata per ottenere RCE. Includ...

CVE-2023-43208-PoC

Mirth Connect RCE Exploit CVE-2023-43208 Questo script è una Prova di Concetto PoC per la vulnerabilità di Esecuzione Remota di Codice RCE in Mirth Connect versioni precedenti alla 4.4.1. Sfrutta una vulnerabilità di deserializzazione di XStream tramite l'API. Requisiti Python 3.10 o superiore...

PoC-CVE-2025-55182

PoC: CVE-2026-33017 Una vulnerabilità di esecuzione remota di codice pre-autenticazione esiste nelle versioni 19.0.0, 19.1.0, 19.1.1 e 19.2.0 di React Server Components, inclusi i seguenti pacchetti: react-server-dom-parcel, react-server-dom-turbopack e react-server-dom-webpack. Il codice...

MAL-2026-15544 Malicious code in sentrykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7070cc1752fa75b405bdd0617a934d29519df28fdd0d069c0d4b5f7adaf44f55 package.json declares a self-referential dependency where the key sentrykit maps to the bare HTTPS URL https://repo.securityctrl.com/sentrykit instea...

Malicious code in sentrykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7070cc1752fa75b405bdd0617a934d29519df28fdd0d069c0d4b5f7adaf44f55 package.json declares a self-referential dependency where the key sentrykit maps to the bare HTTPS URL https://repo.securityctrl.com/sentrykit instea...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

MAL-2026-15526 Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...