Astra Linux – Vulnerability in xrdp

xrdp is an open-source RDP server. Versions up to 0.10.5 contain a heap-based buffer overflow vulnerability in the NeutrinoRDP module. When proxying RDP sessions from xrdp to another server, the module fails to properly validate the size of reassembled fragmented virtual channel data against its...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: firmwareloader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hexadecimal numbers or similar elements. However,...

CVE-2026-42945-nginx-rift-poc

NGINX Rift — CVE-2026-42945 RCE proof-of-concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. Enables unauthenticated remote code execution against servers using rewrite ... ?... + set capture combinations. Original vulnerability...

ModuleStomping

Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...

CVE-2025-57819-FreePBX-RCE2Root

CVE-2025-57819 — FreePBX SQLi → RCE → Root Full-chain PoC for CVE-2025-57819. Unauthenticated error-based SQL injection in FreePBX's endpoint module chains into a root shell via cron job injection and incron privilege escalation. For authorized testing and research only. Do not use against system...

CVE-2019-9053-port-py3

Exploit CVE-2019-9053 - Python 3 Este es un port a Python 3 del exploit CVE-2019-9053, que afecta a versiones de CMS Made Simple CMSMS anteriores a la 2.2.10. La vulnerabilidad permite inyección SQL a través del módulo News. Salida de ejemplo Probado en el TryHackMe Simple CTF Challenge...

lblfixer_cve_2023_30839

LabelGrup Networks, socio oficial de PrestaShop Módulo para PrestaShop 1.7.8.9 para corregir las vulnerabilidades CVE-2023-30545, CVE-2023-30839 y CVE-2023-30839 Para más información, consulte los siguientes enlaces: CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-30545 CVE:...

nginx-rift-detect

nginx-rift-detect Behavioral detection script for CVE-2026-42945 NGINX Rift — a heap buffer overflow in ngxhttprewritemodule present in nginx since 2008. ⚠️ Disclaimer This tool is intended solely for authorized security testing and research. Only run this against systems you own or have explicit...

CVE-2026-42945

CVE-2026-42945 Nginx Rift - Kit de Prueba de Concepto PoC Un kit completo de prueba de concepto para CVE-2026-42945 Nginx Rift, una vulnerabilidad crítica de desbordamiento de búfer en el montón en el módulo ngxhttprewritemodule de Nginx. Resumen de la Vulnerabilidad Campo| Detalles ---|--- ID CV...

CVE-2026-31431_je_sappelle_RoOt

CVE-2026-31431 - Copy Fail - Je s'appelle ROOT ! 📌 Repository Purpose This repository documents the CVE-2026-31431 vulnerability, nicknamed Copy Fail , and provides a defensive remediation procedure for potentially exposed Linux systems. ⚠️ This repository is strictly focused on defense, authorize...

EUVD-2026-92301

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

tf-cve-2021-36782

Módulo de Terraform de demostración para CVE-2021-36782 Este es un módulo de Terraform para demostrar CVE-2021-36782. Inicio rápido Clonar el repositorio Ejecutar terraform init Copiar example.tfvars a yourown.tfvars Editar yourown.tfvars. Solo necesitas agregar un token de API de DigitalOcean...

CVE-2026-5203

CVE-2026-5203 — CMS Made Simple ≤ 2.2.22 RCE Path Traversal + Subida Arbitraria de Archivos Resumen La funcionalidad de importación XML del módulo UserGuide en CMS Made Simple ≤ 2.2.22 no sanitiza los nombres de archivo proporcionados por el usuario, lo que permite a un administrador autenticado...

CVE-2022-24483

CVE-2022-24483 POC Para CVE-2022-24483 Un error de divulgación de información en la función "nt!PfpPrivSourceEnum". Fiabilidad: Alta...

Modified-CVE-2020-10915-MsfModule

Modified-CVE-2020-10915-MsfModule ESTO NO ES UN EXPLOIT ORIGINAL. ES UNA VERSIÓN AUDITADA PARA UNA MÁQUINA DE THM A continuación, los enlaces para el original, la máquina de tryhackme y mi writeup para la máquina:...

dirty_frag_mitigation

dirtyfragmitigation 1. A bash script for mitigating linux dirty frag exploit CVE-2026-43500 2. Works on all Debian/Ubuntu Arch based platforms i.e. Kali, ParrotSec, BlackArch 3. Added --check to run as non-root user. Added fragnesia support as it shares the same patch surface with dirtyfrag...

FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — SQLi no autenticado a RCE como root Gravedad: Crítica Tipo: Inyección SQL no autenticada → Ejecución remota de código Software afectado: FreePBX módulo endpoint Probado en: FreePBX en CentOS 7, Apache 2.4, PHP 7.4, MariaDB 5.5 Resumen Existe una vulnerabilidad de inyecció...

pam_pkcs11

This project is no more maintained I @LudovicRousseau do not use this software any more and have no time to take care of it. See "Pam-pkcs11 needs a new maintainers soon, or it will die" https://sourceforge.net/p/opensc/mailman/message/35191905/ If you want to become the new maintainer just ask m...

CVE-2022-25062

CVE-2022-25062 Este script explota una vulnerabilidad IoF en el router TPLink WR840N, utilizando un campo para inyectar código en el módulo DNS...

K000163535: Go vulnerability CVE-2026-42501

Security Advisory Description A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy GOMODPROXY or checksum database GOSUMDB. A malicious module prox...