cve-2026-31431-mitigation

CVE-2026-31431 Copy Fail – Technical Mitigation Tooling 1. Overview This package provides an automated solution to detect and mitigate the CVE-2026-31431 vulnerability aka Copy Fail on Linux systems running affected kernels versions 4.14 through 6.12.84, 6.13 through 6.18.21, etc.. The tooling...

HackTheBox-Facts

HTB Facts — Full Writeup OS: Linux Tags: Web, MinIO, Camaleon CMS, Path Traversal, Privilege Escalation Table of Contents 1. Reconnaissance 2. Web Enumeration — Port 80 3. MinIO Discovery — Port 54321 4. Camaleon CMS — Admin Access 5. Privilege Escalation to Admin Role 6. MinIO Credentials...

magnus_billing_7.3.0_RCE_CVE-2023-30258

magnusbilling7.3.0RCECVE-2023-30258 There is a remote code execution vulnerability in magnus billing 7.3.0, in the parameter "democ" from the "icepay.php" resource, where you can escape the query and execute the command you want. VULNERABLE CODE if isset$GET'democ' if strlen$GET'democ' 5 exec"tou...

CVE-2025-67261

CVE-2025-67261 - Content-based blind SQL injection on Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page. The "Search" function under the "Orders" page...

NFtables-IPtables-integration-script

🛡️ Q-Feeds Linux Firewall Blocklist Integration Automated malware IP blocklist for Linux servers — supports nftables and iptables+ipset 📋 Table of Contents Quick Start Overview How It Works Prerequisites Detailed Installation Configuration Usage and Verification Troubleshooting Uninstalling Licens...

Exploit for CVE-2026-61424

CVE-2026-61424 Unauthenticated arbitrary file upload in the D...

ghostlock-s26

GhostLock - Android wrapper indev.ghostlock.s26 One-click Android wrapper for polygraphene/ghostlock-s26: GhostLock CVE-2026-43499 ported to the whole Samsung Galaxy S26 series Android 16 / GKI 6.12. One APK, three kernel lines, runtime parameter matching - no per-build app variants. Use only on...

POC_CVE-2024-10829

POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...

CVE-2021-38304-PoC

CVE-2021-38304 Proof of Concept Overview This repository contains a proof of concept for a critical security vulnerability in older versions of the National Instruments nipalk.sys driver. The vulnerability allows for arbitrary code execution and memory disclosure in kernel mode. It is intended...

CVE-2026-43284-dirtyfrag-detection

DirtyFrag CVE-2026-43284 PoC Validation and auditd Detection Scope: Linux Local Privilege Escalation LPE validation focused on the XFRM/ESP path associated with CVE-2026-43284. This repository contains an English report and evidence artifacts from a controlled laboratory validation of the public...

MAL-2026-17651 Malicious code in @praveenvjpm/color-utils-7210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b29d9da4319a314669b87ffd4bc0d736dbf3f4c16803e0363ecb36288c7bb2 On npm install, the package's preinstall hook executes install.js, which collects host identifiers os.hostname, process.cwd, username and reads flag...

Malicious code in @praveenvjpm/color-utils-7210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b29d9da4319a314669b87ffd4bc0d736dbf3f4c16803e0363ecb36288c7bb2 On npm install, the package's preinstall hook executes install.js, which collects host identifiers os.hostname, process.cwd, username and reads flag...

Exploit for Improper Access Control in Ollyo Helix3

CVE-2026-49049 — Helix3 Joomla Unauthenticated Arbitrary JSO...

nextjs-cve-2026-23870-checker

@emstack/nextjs-cve-2026-23870-checker CLI checker and fixer for all 13 vulnerabilities in the Next.js May 2026 Security Release, including CVE-2026-23870 DoS in React Server Components. Quickstart Interactive mode recommended npx @emstack/nextjs-cve-2026-23870-checker Check a project npx...

ejbca-pqc-lab

EJBCA Pure PQC Lab — ML-DSA-65 Two-Tier PKI Hierarchy A hands-on implementation of NIST FIPS 204 ML-DSA in a two-tier PKI hierarchy using EJBCA Community Edition. 📖 Full walkthrough: Building a Post-Quantum PKI: How I Signed a Root CA and Sub CA Using ML-DSA on EJBCA What This Lab Builds A comple...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the Brocade Fabric OS WebTools management interface, affecting versions before 9.2.2d and 10.0.0 through 10.0.0a1 . The root cause is a failure to properly validate and sanitize a user-supplied status file path parameter during configuration ...

EUVD-2026-94686

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87678

An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication FA, the system fails to sanitize the Identity Provider IdP issuer parameter. An authenticated administrator—or an...