2572762 matches found
POC-CVE-2017-8464-OpenCalculator
CVE-2017-8464 / ricerca + PoC Crea 1 Shortcut + 1 .DLL contenente payload dannoso = Mettilo in una USB e invialo alla vittima = la vittima apre la USB = il Payload si attiva automaticamente ! Causa principale 1. Prima di tutto dobbiamo sapere esattamente da dove nasce questo bug! È dovuto alla...
CVE-2018-7600
POC für CVE-2018-7600 Drupal RCE CVE-2018-7600 Vergiss nicht, deine Adresse in das Skript ! Beschreibung: In mehreren Subsystemen von Drupal 7.x und 8.x existiert eine Schwachstelle zur Remote-Code-Ausführung. Dies könnte Angreifern ermöglichen, mehrere Angriffsvektoren auf einer Drupal-Website...
cpu_rec_rs
cpurecrs Bestimmt, welche CPU-Architektur in einer Binärdatei verwendet wird. Beispiel: root@kitploit: $ cpurecrs /bin/bash /usr/lib/firmware/rtlwifi/rtl8821aefw Loading corpus from cpureccorpus/.corpus ---------------------------------------------------------------------------------------- File ...
mimikatz
mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. root@kitploit:...
CVE-2026-66492
Pfad-Traversal im Zielverzeichnis des Datei-Uploads PhocaCommander ≤ 6.1.3 — Authentifizierter Administrator schreibt Dateien außerhalb des Webroot ZUSAMMENFASSUNG Der Datei-Upload-Handler in PhocaCommander erstellt den Zielpfad aus einem angreiferkontrollierten, base64-kodierten folder-Parameter...
Malicious code in ozturk-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99e9596887f3f2f79c96c517c99990def7caa32883f97e9486ed2b52e1e90cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in mfa-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...
MAL-2026-15493 Malicious code in ozturk-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99e9596887f3f2f79c96c517c99990def7caa32883f97e9486ed2b52e1e90cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15492 Malicious code in mfa-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...
GHSA-298F-872V-2RCX ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
Summary A malicious OCI registry can return a cyclic referrer graph e.g. A - A or A - B - A. The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service. This affects oras discover...
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
Summary A malicious OCI registry can return a cyclic referrer graph e.g. A - A or A - B - A. The ORAS CLI's recursive referrer traversal does not track visited descriptors, so a cycle causes unbounded recursion and memory growth — a client-side denial of service. This affects oras discover...
XSS2Shell-CVE-2026-64638
CVE-2026-64638 — XSS2Shell WordPress Pre-Auth Reflected XSS → Remote Code Execution Chain DOM Clobbering + Application Password Diebstahl + REST-API-Plugin-Aktivierung = Vollständige RCE ⚡ Übersicht CVE-2026-64638 ist eine kritische Pre-Authentifizierungs-Reflected-XSS in WordPress wp-login.php...
Malicious code in eip712-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...
MAL-2026-15489 Malicious code in borsh-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b812b22106f1cca7ef260dde0b9d4f777df056795eef04f7469dfaa07199a811 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in clmm-fee-audit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f02c609cf600fc03561a54a3f71bf18fc9d6c0e16b155ea6fbee5fe90c3ce124 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15490 Malicious code in clmm-fee-audit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f02c609cf600fc03561a54a3f71bf18fc9d6c0e16b155ea6fbee5fe90c3ce124 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15491 Malicious code in eip712-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...
Malicious code in borsh-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b812b22106f1cca7ef260dde0b9d4f777df056795eef04f7469dfaa07199a811 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...
EUVD-2026-67859
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...