572 matches found
halborn-ctf (>=0.1.0, <=0.1.20) potentially affected by CVE-2025-23217 via mitmproxy (10.3.0)
mitmproxy PYPI version 10.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - halborn-ctf =0.1.0, =0.1.20 Source cves: CVE-2025-23217 Source advisory: OSV:GHSA-WG33-5H85-7Q5P...
Malicious code in is-number-ctf (npm)
The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 293adcb6e55e85876a036859d67bad46448785e1ef890c061977fb93cd4fe97a Any computer that has this package installed or running should be...
MAL-2025-736 Malicious code in is-number-ctf (npm)
The package opens up arbitrary backdoor port that allows bad actors to connect to. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 293adcb6e55e85876a036859d67bad46448785e1ef890c061977fb93cd4fe97a Any computer that has this package installed or running should be...
Exploit for Deserialization of Untrusted Data in Apache Tomcat
CVE-2020-9484 with interactive mode and args Designed speci...
Exploit for Code Injection in Sqlpad
CVE-2022-0944 SQLPad - Template injection This is a blind vul...
Exploit for Unrestricted Upload of File with Dangerous Type in Git
CVE-2024-32002 1. Edit exploit.sh file replace the reposit...
Introducing the Prompt Airlines CTF: Test Your AI Security Skills
Wiz is excited to announce "Prompt Airlines," a new cloud security Capture The Flag CTF event focused on AI vulnerabilities...
Exploit for Unrestricted Upload of File with Dangerous Type in Chamilo Chamilo_Lms
CVE-2023-4220-Exploit LMS Chamilo 1.11.24 CVE-2023-4220 Explo...
Exploit for Code Injection in Reportlab
CVE-2023-33733-POC Disclamer I did not, nor do I take credi...
GZ::CTF security vulnerability
GZ::CTF is an open source CTF platform based on ASP.NET Core by GZTime Individual Developers. A security vulnerability exists in GZ::CTF versions prior to 0.20.1, which originates from a cross-site scripting attack that can be performed by an unprivileged user on other users by constructing a...
CVE-2024-34699: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...
CVE-2024-34699 GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.
GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...
CVE-2024-34699
GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in "v0.20.1"...
CVE-2024-34699
GZ::CTF (prior to v0.20.1) is vulnerable to cross-site scripting by unprivileged users attempting to craft team names; fixed in v0.20.1. The CVE-2024-34699 entry shows CVSS 3.1 base score 6.5 (Medium) with Adjacent access, no privileges, user interaction none, and high availability impact. Remedi...
CVE-2024-34699 GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.
GZ::CTF is a capture the flag platform. Prior to 0.20.1, unprivileged user can perform cross-site scripting attacks on other users by constructing malicious team names. This problem has been fixed in v0.20.1...
Nginx 1.25.5 Host Header Validation Vulnerability
Nginx versions 1.25.5 and below appear to have a host header filtering validation bug that could possibly be used for malice. Nginx = 1.25.5 $host variable validation bug Intro: In the "Host" header sent to Nginx web server you can't just insert a dot or something like that, because a filtering...
Internet Bug Bounty: Libuv: Improper Domain Lookup that potentially leads to SSRF attacks
The vulnerability in the libuv library was caused by the improper truncation of hostnames to 256 characters before calling the getaddrinfo function. This behavior allowed the creation of addresses like 0x00007f000001, which were considered valid by getaddrinfo, potentially leading to SSRF attacks...
Announcing the K8s LAN Party Challenge
Test your investigation skills and K8s network knowledge in a new CTF event: the K8s LAN Party Challenge!...