CVE-2026-55157: Improper Neutralization of Special Elements used in an OS Command

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. Any MCP client that can call the smartuser too...

D-Link DIR-605 - Information Disclosure

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version - 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page id: CVE-2021-40655 info: name: D-Link DIR-605 - Information Disclosure author: DhiyaneshDK severity: high...

chakra-2016-11

chakra.dll 信息泄露 + 类型混淆实现远程代码执行 针对 Edge 漏洞（CVE-2016-7200 和 CVE-2016-7201）的概念验证利用代码 已在 Windows 10 Edge（modern.ie 稳定版）上测试。 FillFromPrototypesTypeConfusion.html: WinExec notepad.exe FillFromPrototypesTypeConfusionNoSC.html: 0xcc INT 3 运行 1. 下载 exploit/FillFromPrototypesTypeConfusion.html 到某个目录。 2. 使用...

ntlmscout

/ // / / / / / / / / // / / / / / / / / / / / / / / / / // // / // / / // / // // / / /// //, // 猎捕暴露的 NTLM BoydHacks · github.com/BoydHacks ntlmscout 一款工具，从互联网暴露的 NTLM 端点中榨取每一滴信息。 一次未经身份验证的 NTLM 协商，在发送任何凭据之前，就会泄露大量令人惊讶的内部 Active Directory 细节。ntlmscout 会在多种传输协议上发送 NTLM Type-1（NEGOTIATE）消息，完整解码返回的...

CVE-2025-24813-PoC

CVE-2025-24813 – 概念验证 📖 概述 该仓库包含针对 CVE-2025-24813 的 概念验证 PoC ，该漏洞影响 受影响软件/产品名称 – 根据公告更新。 PoC 以 安全且可复现的方式 演示该问题，以帮助研究人员、防御者和工程师在不同环境中验证补丁。 ⚠️ 免责声明 本 PoC 仅供 教育和研究目的 使用。 不得在未经明确授权的情况下对系统使用。作者对任何滥用行为不承担任何责任。 🧩 漏洞详情 CVE ID : CVE-2025-24813 严重性 : 严重 CVSS 9.x – 如有更新请更新 影响 : 远程代码执行 / 权限提升 / 信息泄露 根据实际CVE调整...

CVE-2018-1313

此存储库没有 README。...

W3TotalChache

W3TotalChache 用于测试 CVE-2019-6715（任意文件读取）/ CVE-2024-12365（SSRF/信息泄露） 用法： python3 w3tcscanner.py -u https://example.com -f /etc/passwd -d 3 import requests import argparse from urllib.parse import urlparse def checkw3tcversionurl: try: response = requests.geturl, timeout=10 headers = response.heade...

CVE-2024-50848

CVE-2024-50848: WorldServer v11.8.2 中的 XXE 漏洞 WorldServer v11.8.2 的导入对象和翻译记忆库导入功能中存在 XML 外部实体 XXE 漏洞，攻击者通过提供特制的 .tmx 文件，可能导致访问敏感系统信息并执行任意命令。 要利用此漏洞，经过身份验证的攻击者需要构造一个包含恶意负载的 .tmx 文件，其中包含现有系统文件或目录的路径。上传包含恶意内容的文件后，目标服务器将在警告消息中返回指定的系统文件夹或文件内容。 发现者：Nikita Hrab，2024 年 7 月 参考资料：...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

PT-2026-99359

Name of the Vulnerable Software and Affected Versions Budibase server versions prior to 3.45.0 Description An information disclosure issue exists where authenticated users can access application metadata and source code belonging to another tenant. By providing a victim tenant's appId to the 'GET...

CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-97915

The Linux kernel contains a vulnerability in the accel/ivpu component where the name field in struct vpu_tracing_buffer_header is populated by the NPU firmware. Because the host side does not enforce NUL-termination on this fixed-size array, using an unbounded string conversion can lead to an out...

MAL-2026-17182 Malicious code in app-sca-info-banking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...

Malicious code in app-sca-info-banking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...

PT-2026-99120

Name of the Vulnerable Software and Affected Versions SCBE-AETHERMOORE versions 4.0.2 through 4.2.0 Description The AetherBrowser API server scripts/aetherbrowser/api server.py exposes the POST /api/ops/check-email endpoint without authentication. A remote attacker can call this endpoint to trigg...

PT-2026-98815

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NVMe subsystem where the nvme query fdp info function is called per-path, leading to potential concurrent access issues. Specifically, the function populat...

CVE-2026-97368

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

EUVD-2026-86467

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97368

A weakness exists in chillzhuang SpringBlade versions up to 5.0.2 , specifically within the UserServiceImpl.userInfo function located in the blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java file of the user-auth-info Endpoint . An attacker can remo...

CVE-2026-97368 chillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...