Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

Plone Docker - Host Header Injection

Plone Docker Official Image 5.2.13 5221 is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting XSS attacks when the malicious Host header value is reflected in the response. id: CVE-2024-23055 info: name: Plone Docker ...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

ExponentCMS <= 2.6 - Host Header Injection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. id: CVE-2021-38751 info: name: ExponentCMS = 2.6 - Host Header Injection author:...

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

creak

creak Performs some of the most famous MITM attack on target addresses located in a local network. Among these, deny navigation and download capabilities of a target host in the local network performing an ARP poison attack and sending reset TCP packets to every request made to the router. Born a...

Malicious code in schoolwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fab9688948b5e3cab55bea7282280a554f1e60f85b947724b5f9262cd6a1823 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in iwantaburger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 660011f86e2c92f83c584ac25343cc8d8da3a4242286e751d9e8bc0bd8510a68 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in schoolhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 207beec4a342cd3a46c5a21ea6b76c3e84e88374f40a76b6c5761859a76ea2c4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in whatsgoodlookingbabycreed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e598067256b5fe5407b1f8b201925a118b6a08ea19be59cc80db3c60082fe19b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2022-24181

CVE-2022-24181 e CVE-2022-26616. Ambos são provavelmente iguais. Open-journal-system-Vulnerability XSS via injeção de Host Header e roubo do token de redefinição de senha de outro usuário Passos para reproduzir: 1. Acesse este site: https://who's-using-ojs-software.com 2. Capture esta solicitação...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour Questo codice è solo a scopo educativo e per ambienti controllati come laboratori Hack The Box. Non usare su sistemi senza autorizzazione. Questo repository contiene uno script di sfruttamento per la vulnerabilità Docker Remote API esposta senza...

CVE_2026_31694

Scanner Passivo CVE-2026-31694 Uma ferramenta passiva de avaliação de hosts Linux para CVE-2026-31694 , uma escrita fora dos limites no cache readdir do FUSE no kernel Linux. O scanner avalia o kernel em execução, a exposição do FUSE, os metadados de pacotes locais, as evidências do código-fonte ...

Zapscape

Die KVM-Escape-Trilogie ITScape CVE‑2026‑46316 | Januscape CVE‑2026‑53359 | Zapscape CVE‑2026‑64561 ---|---|--- Zapscape: Guest-to-Host-Escape in KVM/x86 Zusammenfassung Dieses Dokument beschreibt die Zapscape CVE-2026-64561 -Sicherheitslücke, die von Hyunwoo Kim @v4bel entdeckt und gemeldet wurd...

CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB JAVASCRIPT-Trigger-Skript-RCE nach Authentifizierung Remote-Codeausführung nach der Authentifizierung in ArcadeDB einer Java-Multi-Model-Datenbank über einen JAVASCRIPT-Trigger , der Host-Klassen erreicht. Die GraalVM-Polyglot-Engine eines Triggers wird mit einer...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – Container-Escape über /proc/self/fd-Symlink Übersicht Ein gemeinsam genutztes Volume, das mit rshared-Propagation eingebunden ist, ermöglicht einem bösartigen Container, über /proc/self/fd einen symbolischen Link zu erstellen, der auf eine Host-Datei zeigt. Der in das Volume...

Zeek-Endpoint-Enrichment

Zeek-Endpoint-Enrichment Zeek-Logs mit Host-Informationen anreichern Um alle Logs mit einem id-Feld anzureichern, verwenden Sie das Tag ".-all". Um alle Logs mit einem id-Feld und den Known Entities anzureichern, verwenden Sie das Tag ".-known-all". Um nur die conn.log anzureichern, verwenden Sie...

cve-2024-34351-demo

CVE-2024-34351 Demo Minimale Next.js 14.0.0-Anwendung zur Demonstration von CVE-2024-34351 – einer Server-Side Request Forgery SSRF-Schwachstelle in Next.js Server Actions. Entdeckt von Adam Kues und Shubham Shah bei Assetnote. Behoben in Next.js 14.1.1. Wie die Schwachstelle funktioniert Wenn ei...

CVE-2024-21626

CVE-2024-21626 शोषण कार्यशील निर्देशिका docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm महत्वपूर्ण है कि -w /proc/self/fd/8 रखें\ होस्ट फ़ाइलसिस्टम तक पहुँचने के लिए कंटेनर के अंदर cat ../../../../../../../../../etc/passwd कमांड का उपयोग करें शोषण सिमलिंक 1. docker ru...

CVE-2020-23342

CVE-2020-23342 Hinweis: Achten Sie beim Ausführen dieses Repositorys mit Docker in einer lokalen virtuellen Maschine darauf, den Wert von host in Zeile 24 von config.py auf die IP der virtuellen Maschine zu ändern...