Malicious code in create-json-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2025-63080

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2025-63080

KAON PG5298A and PG5298B routers contain an insufficient access control flaw in their JSON-RPC interface . An authenticated user on the adjacent network can send crafted JSON-RPC requests to perform operations that are otherwise restricted to the GUI, enabling system file read or command executio...

EUVD-2025-210761

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2025-63080 Authenticated RCE in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

deadfinder

Find dead-links broken links Documentation • Installation • Github Action • Contributing • Changelog Dead link broken link means a link within a web page that cannot be connected. These links can have a negative impact to SEO and Security. This tool makes it easy to identify and modify. Looking f...

Astra Linux – Vulnerability in Zabbix

The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files using zbxjsonopen...

Astra Linux – Vulnerability in python-jwcrypto

JWCrypto implements the JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker could cause a denial-of-service attack by passing in a malicious JWE Token with a high compression ratio. When the server processed this token, it would consume a lot of memory...

ghauri

Like Ghauri, consider supporting the developer...

ipsourcebypass

This Python script can be used to bypass IP source restrictions using HTTP headers. Features 17 HTTP headers. Multithreading. JSON export with --json outputfile.json. Auto-detecting most successful bypasses...

CVE-2025-59057-PoC

Una vulnerabilità XSS esiste nei metodi meta/ di React Router in Framework Mode quando si generano tag script:ld+json, che potrebbe consentire l'esecuzione arbitraria di JavaScript durante SSR se contenuti non attendibili vengono usati per generare il tag...

cypherhound

CypherHound A Python3 terminal application that contains Neo4j cyphers for BloodHound data sets with a script to automate importing them into BloodHound CE. Output Samples Terminal HTML Report HTML Report continued Why? BloodHound is a staple tool for every penetration tester. However, there are...

laurel

Linux Audit – Usable, Robust, Easy Logging LAUREL is an event post-processing plugin for auditd8 that generates useful, enriched JSON-based audit logs suitable for modern security monitoring setups. Documentation corresponding to the latest stable release can be found here. Why? TLDR: Instead of...

cfgrip

cfgrip PE/ELF x86/x64 CFG-Extraktor. Nimmt eine Binärdatei entgegen, zerlegt sie, löst jeden Sprung und Aufruf auf GOT, Sprungtabellen, Registerverfolgung und exportiert den vollständigen Kontrollflussgraphen als strukturiertes JSON. warum Du musst genau wissen, wohin jeder Zweig führt. Nicht zum...

CVE-2025-55182-POC

CVE-2025-55182 – Scanner de Vulnerabilidade de Injeção de Comando Prova de Conceito Completa com Saída de Comando Real Este repositório contém um scanner de prova de conceito PoC baseado em Python para o CVE-2025-55182, demonstrando como um invasor poderia explorar uma vulnerabilidade de injeção ...

vamp-forticheck

vamp-forticheck VampSecure Labs — Divisão de Pesquisa em Segurança Scanner de vulnerabilidades críticas em dispositivos FortiOS/FortiGate. Descrição Ferramenta de auditoria de segurança para avaliar a exposição de dispositivos Fortinet a quatro vulnerabilidades críticas publicamente documentadas...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: root@kitploit: ▶ grep -HnrE...

attack-stix-data

Dati STIX ATT&CK® MITRE ATT&CK è una base di conoscenza accessibile a livello globale di tattiche e tecniche degli avversari basata su osservazioni del mondo reale. La base di conoscenza ATT&CK è utilizzata come fondamento per lo sviluppo di modelli di minaccia e metodologie specifici nel settore...

CVE-2026-78207 exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and...

PT-2026-80909

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interprete...