CVE-2025-32206

CVE-2025-32206 - WordPress Processing Projects "Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects allows attackers to upload a web shell to a web server. This can lead to full compromise." 🧑‍💻 Exploit Description This Python exploit script targets WordPress...

CVE-2018-18387

CVE-2018-18387 playSMS = 1.4.2 - Privilege escalation TMHC TEAM found a vulnerability that lead to a priviledge escalation through playSMS/web/init.php that can lead to a complete system compromise. The attacker need to get access on the box where playSMS is installed and be able to edit playSMS...

MAL-2026-17626 Malicious code in serpacksven1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6 The tarball ships no JavaScript — the declared main: index.js is absent — and contains only 10 byte-identical copies of a PowerShell dropper under...

Malicious code in serpacksven1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6 The tarball ships no JavaScript — the declared main: index.js is absent — and contains only 10 byte-identical copies of a PowerShell dropper under...

Malicious code in dzyhaxz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08fd08c1026dee023b11946f939f5fb1c5763566c9577ccb99c2aa7a3c0c2684 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dzyclutch-libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63716521c367b7aea5217499683a4fced3139831cc949b92387538692a679287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diezyclutch/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbb98590d5b8584ba109e1688c1fdda2aceb0b44bb436989b48273a8055bbe57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @subql/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f636fe7b88ce4be7e029a7685f097fe9dc65090b919906ddf0368a3c07a3464a package.json declares a postinstall hook node./dist/project/readers/manifest-cache.js. That file embeds 60KB of base64 chunks under MANIFESTCACHESEED...

CVE-2026-104809

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

metasploit-pentest-report

Authorized Penetration Test: Metasploit Lab Scope and Authorization All targets used in this project are explicitly authorized: Target| IP| Authorization Basis ---|---|--- Metasploitable2| 192.168.3.130| Self-hosted VM on isolated host-only network. Intentionally vulnerable VM built for security...

Malicious code in translate-base-font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b0c647653ce1698d15162d24ea22d9b060d770daf28277f3ce27a0040dda6dc The package presents itself as a CSS custom-property polyfill for font translation, but its actual behavior is a browser-side code-smuggling vector...

Malicious code in ui.dist.min.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf50ae695b73c6662269893d9ac1f677ce5be474e9648bfa23cdfb35b1b04a3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17458 Malicious code in translate-base-font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b0c647653ce1698d15162d24ea22d9b060d770daf28277f3ce27a0040dda6dc The package presents itself as a CSS custom-property polyfill for font translation, but its actual behavior is a browser-side code-smuggling vector...

Malicious code in illusion-datalab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6004785b370b58ab360f70d7959fad47ec55ec609e8556217976fc405a610b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ashwesker-CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” A critical, unauthenticated vulnerability allowing full compromise of n8n servers 🆔 Overview Field| Details ---|--- CVE ID| CVE-2026-21858 Codename| Ni8mare Severity| 🔴 Critical CVSS Score| 10.0 Maximum Attack Vector| 🌐 Network Authentication Required| ❌ None User...

CVE-2026-21017-LDAP-Anonymous-Bind-Privilege-Escalation

CVE-2026-21017 – LDAP Anonymous Bind Privilege Escalation Program Code Python ldap3 sim ldapanonsim.py - LDAP server allowing anonymous bind with write access from ldap3 import Server, Connection, ALL Simulated: real server would be misconfigured server = Server'ldap://localhost:389', getinfo=ALL...

Malicious code in @cat-gen/materia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 354c3f4dedaabc169ba0f7a5ccb99a5a77e7ef99c194854add673e7dac98d30f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17334 Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @redman89405/my-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58f8e0d965e65d298a38295487ebe0c363ea7da343649827903915cc655f3730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...