CVE-2025-56383-Proof-of-Concept

Notepad++ v8.8.3 存在 DLL 劫持漏洞，可以通过替换原始 DLL 文件来执行恶意代码。 示例方法如下： （请注意，以下演示使用 npp.8.8.3.Installer.x64.exe 安装 Notepad++ 进行测试，但实际上，任何已安装的 Notepad++ 都会受到此漏洞的影响） 将原始 DLL（例如 Notepad++\plugins\NppExport\NppExport.dll）替换为包含恶意代码的同名 DLL 文件（原始导出函数被转发到原始 DLL），这样在执行 Notepad++.exe 时，就可以执行恶意代码。...

CVE-2023-35674

描述 CVE-2023-35674 是一个存在于 Android Framework 中的高危零日安全漏洞。该漏洞允许攻击者无需用户交互或额外执行权限即可提升自身权限。 该漏洞出现在 Android Framework 处理应用程序包缓存文件的方式中。攻击者可以利用该漏洞修改应用程序的缓存文件以执行恶意代码。 该漏洞于 2023 年 8 月 22 日报告给 Google，Google 于 2023 年 8 月 2 日发布了修复更新。 攻击者可以利用该漏洞在 Android 设备上安装恶意软件、窃取个人信息或控制设备。 关于 CVE-2023-35674 漏洞的更多细节： 类型: 零日...

threatDemos

🚨 Android 安全威胁演示仓库 Android 安全漏洞与攻击向量的综合概念验证集合 本仓库作为教育资源，展示真实世界的 Android 安全威胁 及其相应的缓解策略 。每个演示都包含可运行的代码示例、详细的攻击向量和安全控制措施，帮助开发者理解并防止这些漏洞出现在生产应用中。 ⚡ 本仓库持续维护并不断扩展 🎯 仓库目标 🔍 演示真实的 Android 漏洞 ，附带可运行的概念验证代码 🛡️ 提供安全控制措施 以及每种威胁的缓解策略 📚 教育开发者 认识常见的 Android 安全陷阱 🧪 验证安全工具 ，如 MobSF 及其漏洞检测能力 ⚡ 研究前沿的 Android 利用技术 🗂️...

EUVD-2026-88199

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7170: parameter 'vendorstorename' in the endpoint '/administrator/index.php?pshopmode=admin&page=store.storeadd&option=comvirtuemart&vendorid=ID'. Successful exploitation of this vulnerability...

CVE-2026-77147: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

CVE-2026-9852: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...

AKRASIA: Stealthy Backdoor Attack on Reasoning-Based Code LLMs

We present AKRASIA, a stealthy, inference-time backdoor attack against reasoning-based Code LLMs. AKRASIA aims to achieve a backdoor target e.g., malicious code execution in reasoning LLMs while evading automated defenses and human inspection. To achieve this, AKRASIA probes the victim LLM to...

CSV file injection vulnerability in BaserCMS

Overview BaserCMS provided by baserCMS Users Community contains the following vulnerability. Improper neutralization of formula elements in a CSV file CWE-1236 - CVE-2026-65875 This vulnerability was reported by the following persons to JPCERT/CC. JPCERT/CC coordinated with the developer. VCSLab ...

EUVD-2026-52014

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...

CVE-2026-65875: Improper Neutralization of Formula Elements in a CSV File

BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed...

MAL-2026-10047 Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

CVE-2026-50195

A flaw was found in containerd, an open-source container runtime. The CRI Container Runtime Interface checkpoint import process fails to validate image references within a checkpoint image's configuration. An attacker with permissions to create pods can exploit this by using a specially crafted...

MAL-2026-6585 Malicious code in stake-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a475d161b669ae748124a4d6c1da29ebda6e40da4aa5c3c5e8b10645ef96f57a On npm install, the package's postinstall hook scripts/install-check.cjs, wired via package.json scripts.postinstall fetches a JSON config from a...

MAL-2026-6491 Malicious code in hexo-deployer-wrangler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebc95a6a1ae1e522feabf03446f9791372191e27ca9da454717559b6cc6948eb The package ships a binding.gyp file line 6 containing GYP command-expansion syntax !... inside the targets/sources fields. npm implicitly runs...

CVE-2026-53858: Untrusted Search Path

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATEDIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATEDIRECTORY variable to load runtime dependencies from unintended local paths, potentially...

CVE-2025-31272

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges...

CVE-2025-31272: Improper Privilege Management

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges...

CVE-2026-33862: Improper Neutralization of Input During Web Page Generation

A vulnerability has been identified in Teamcenter V2312 All versions V2312.0014, Teamcenter V2406 All versions V2406.0012, Teamcenter V2412 All versions V2412.0009, Teamcenter V2506 All versions V2506.0005, Teamcenter V2512 All versions. The affected application does not properly encode or filter...

Malicious code in bytedbackground (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ab2e307770a6b144edad3254d316375ed3cdad0a56f21438b28bcc0f1a17fcb9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in ixosrestinterface (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e2fe4fe4fa9a0b286aec54345ba951ff46306f88ef7f106fa1bd2496e34c7898 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...