MAL-2026-17309 Malicious code in stestenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee35b23a60484ee1d468154734cc7cdbc8c7d3cbc81901ab680cb67e46a8c2b6 On require of the package's main entry, dispatchAnalytics reads a payload hidden in the JPEG APP13 marker 0xFFED segment of the bundled dist/stest.jp...

Audit-BlackBox-Web-to-Root

Pentest Lab : Cadena de explotación web y sistema Drupal to Root Disclaimer Este proyecto se realizó en un entorno de laboratorio controlado y aislado con fines educativos y académicos. No se ha atacado ninguna infraestructura real. El objetivo es aprender a asegurar los sistemas comprendiendo lo...

cisagov__check-cve-2019-19781.4142e02b

check-cve-2019-19781 🔎🐞 Esta utilidad determina si un host parece susceptible a CVE-2019-19781. Requisitos Versiones de Python 3.6 y superiores. Ten en cuenta que Python 2 no es compatible. Instalación Desde una versión publicada: pip install...

CVE-2026-103056

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into...

POC-CVE-2025-55182

Escáner de CVE-2025-55182 Herramienta sencilla de línea de comandos para detectar y explotar CVE-2025-55182 RCE en React Server Components en aplicaciones Next.js. Instalación chmod +x scanner.sh Uso Scan with default command id ./scanner.sh -d example.com Execute custom command ./scanner.sh -d...

CVE-2025-55184

PoC de React2Shell Este repositorio proporciona un entorno mínimo intencionalmente vulnerable para probar escáneres de seguridad contra la reciente vulnerabilidad crítica de RCE React2Shell que afecta a React Server Components y Next.js. CVE-2025-55182 : Existe una vulnerabilidad de ejecución...

CVE-2026-44011-craftcms-auth-rce

CVE-2026-44011 PoC de RCE autenticado en Craft CMS Solo para pruebas autorizadas. El aviso de Craft CMS indica =4.0.0, =5.0.0, ' -c '' Argumentos requeridos: -b, --base-url: URL de Craft, incluyendo http:// o https://. -u, --username: Nombre de usuario del panel de control. -p, --password:...

CVE-2026-44011-poc

CVE-2026-44011 RCE autenticado en Craft CMS mediante inyección de comportamiento de Yii. Afectados: 4.0.0–4.17.11, 5.0.0–5.9.17 Corregido en: 4.17.12, 5.9.18 Aviso: GHSA-qrgm-p9w5-rrfw Vulnerabilidad El endpoint /admin/actions/element-search/search acepta un parámetro condition que se pasa...

CVE-2025-55182-Lab

Laboratorio CVE-2025-55182 Un laboratorio práctico para explotar CVE-2025-55182 React2Shell - Ejecución remota de código en React Server Components. ⚠️ Aviso legal Solo con fines educativos. Prueba únicamente en sistemas que te pertenezcan. Inicio rápido Clonar e iniciar git clone...

CVE-2025-52691

CVE-2025-52691 SmarterMail Unauthenticated Arbitrary File Upload RCE Overview Critical unauthenticated arbitrary file upload allowing remote code execution. Field| Value ---|--- Product| SmarterMail Affected| Build 9406 and earlier CVSS| 10.0 Critical Type| Arbitrary File Upload Vector| HTTP...

EUVD-2026-89534

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

EUVD-2026-89505

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-89479

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function setsyslog of the file /api/ZRnetwork/setsyslog. The manipulation of the argument conloglevel/logsize results in command injection. The attack may be performed from remote. The exploit is now public and may be...

EUVD-2026-89481

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

openssl openssl-4.0.3

Welcome to the OpenSSL Project !openssl logowww.openssl.org !github actions ci badgegithub actions ci OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations ar...

EUVD-2026-89540

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into...

CVE-2026-103056 AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into...

CVE-2026-103056 AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into...

CVE-2026-103056 AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrikertr.py and endpoint.py. Authenticated users can inject single quotes into...

CVE-2026-103056

AiSOC versions 7.2.0 before 12.0.0 are vulnerable to a command injection vulnerability within the actions service. The flaw exists because the application builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Auth...