proxmark3

Iceman Fork - Proxmark3 The Proxmark3 is the swiss-army tool of RFID, allowing for interactions with the vast majority of RFID tags on a global scale. Originally built by Jonathan Westhues, the device is now the goto tool for RFID Analysis for the enthusiast. Iceman repository is considered to be...

CVE-2022-37932

Vulnerabilità di bypass dell'autenticazione nel firmware HP Switch CVE-2022-37932 Versione firmware: PD.02.21 Dispositivi interessati: Switch Smart Managed Serie HP 1920 Panoramica Questo repository documenta una vulnerabilità critica di bypass dell'autenticazione negli Switch Smart Managed Serie...

CVE-2025-67733

RESP Protocol Injection PoC Prova di concetto che dimostra la vulnerabilità di iniezione del protocollo RESP tramite messaggi di errore di script Lua in Valkey/Redis. File backend.py Backend Flask che simula un'applicazione web con connessione Valkey condivisa pool di connessioni. Endpoint:...

CVE-2025-49844

CVE-2025-49844 Originale uv POC: https://github.com/saneki/cve-2025-49844 PoC che fornisce reverse shell. Prima di Iniziare pip3 install -r requirements.txt Aiuto python3 CVE-2025-49844.py -h root@kitploit: usage: CVE-2025-49844.py -h -H HOST -P PORT -a PASSWORD -l HOST -p PORT CVE-2025-49844...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 RCE autenticata FuguHub è un software Cloud Media Server. La versione testata era la versione Debian a questo link: https://fuguhub.com/articles/FuguHub-for-Debian Un problema in Real Time Logic LLC FuguHub v.8.4 consente a un attaccante locale di eseguire codice arbitrario tramite un...

CVE-2020-13151

CVE-2020-13151 POC Aerospike Database 5.1.0.3 Host-Befehlsausführung Vollständiger Artikel @ https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html poc.lua zeigt die manuelle Ausnutzung des Servers cve2020-13151.py für automatisierte Ausnutzung run-poc.sh richtet ei...

nginx-mitigate-log4shell

nginx-mitigate-log4shell Mitiga gli attacchi che sfruttano la vulnerabilità log4shell CVE-2021-44228 e CVE-2021-45046 utilizzando uno script LUA di Nginx Richiede che il modulo lua di Nginx https://www.nginx.com/resources/wiki/modules/lua/ sia abilitato. Utilizzare include...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

CVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

EUVD-2026-53308

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

GHSA-MM6C-5J6X-HQ8M Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

Summary Algernon selects its file handler from filepath.Ext engine/handlers.go:134, which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives it...

CVE-2025-67862

An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability CWE-1244 vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiPro...

Fortinet FortiOS和Fortinet FortiProxy 安全漏洞

Fortinet FortiOS and Fortinet FortiProxy are products of the American company Fortinet. Fortinet FortiOS is a security operating system specifically designed for the FortiGate network security platform. This system provides users with various security features, including firewalls, antivirus...

JLSEC-2026-556

Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...

Astra Linux – Vulnerability in Redis

Redis is an in-memory database that persists data on disk. A specially crafted Lua script executed in Redis can trigger a heap overflow in the cjson library, leading to heap corruption and potentially remote code execution. This issue exists in all versions of Redis that support Lua scripting,...

Astra Linux – Vulnerability in Apache2

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a Lua script that calls r:parsebody0 may cause a denial of service due to the lack of a default limit on the possible input size...

Astra Linux – Vulnerability in Redis

Redis is an open-source, in-memory database that persists data on disk. A authenticated user may use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution. This issue has been fixed in versions 7.4.2, 7.2.7, and 6.2.17. An additional...

CLSA-2026-1778845249 redis: Fix of 2 CVEs

CVE-2026-23631: fix use-after-free in readSyncBulkPayload when fullsync happens while a Lua script is timed out on the replica - CVE-2026-25243: fix invalid memory access in RESTORE on crafted zipmap, listpack and stream PEL payloads...

CVE-2026-42214 Improper Control of Generation of Code ('Code Injection') in dail8859/NotepadNext

Notepad Next is a cross-platform, reimplementation of Notepad++. Prior to version 0.14, NotepadNext's detectLanguageFromExtension function interpolates a file's extension directly into a Lua script without sanitization. An attacker can craft a filename whose extension contains Lua code, which...