Omnia MPX 1.5.0+r1 - Local File Inclusion

Telos Alliance Omnia MPX Node through 1.5.0+r1 is vulnerable to local file inclusion via logs/downloadMainLog. By retrieving userDB.json allows an attacker to retrieve cleartext credentials and escalate privileges via the control panel. id: CVE-2022-36642 info: name: Omnia MPX 1.5.0+r1 - Local Fi...

Mongoose < 8.8.3 - Remote Code Execution

Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. id: CVE-2024-53900 info: name: Mongoose 8.8.3 - Remote Code Execution author: h4mg severity: critical description: | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. impact...

CVE-2018-0114

CVE-2018-0114 Exploit pour Node-jose 0.11.0 écrit en Ruby Utilisation entrez simplement le nom de la victime dans le code et exécutez le fichier via ruby ./exploit.rb Une vulnérabilité dans la bibliothèque open source Cisco node-jose avant la version 0.11.0 pourrait permettre à un attaquant dista...

CVE-2020-28502

CVE-2020-28502 node-XMLHttpRequest RCE Описание NVD Это затрагивает пакет xmlhttprequest до версии 1.7.0; все версии пакета xmlhttprequest-ssl. При отправке запросов синхронно async=False в xhr.open вредоносный пользовательский ввод, передаваемый в xhr.send, может привести к внедрению и выполнени...

kube-alien

Kube-alien Cet outil lance une attaque sur un cluster k8s depuis l'intérieur. Cela signifie que vous devez déjà avoir un accès avec les autorisations nécessaires pour déployer des pods dans un cluster afin de l'exécuter. Après avoir exécuté le pod kube-alien, il tente de prendre le contrôle des...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit Une vulnérabilité dans la bibliothèque open source node-jose de Cisco avant la version 0.11.0 pourrait permettre à un attaquant distant non authentifié de re-signer des jetons en utilisant une clé intégrée dans le jeton. La vulnérabilité est due au fait que node-jose suit la...

CVE-2026-104871

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...

node-ipc-malware-protestware-CVE-2022-23812

CVE-2022-23812 RIAEvangelist/node-ipc — вредоносное ПО / протестное ПО Модуль RIAEvangelist/node-ipc содержит протестное ПО peacenotwar. Выдержка из RIAEvangelist/node-ipc: начиная с v11.0.0 и v9.2.2 этот модуль использует модуль peacenotwar. Что более важно, коммиты...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Удаленное выполнение кода PoC Go proof of concept для CVE-2025-59528 , нацеленный на версии Flowise Пример go run main.go http://target.com h3D9jD7Xzi0V2KSrld9ff4P3rm6cuNXg1uA-wFsUYc "touch /tmp/pwned"...

CVE-2025-59528-PoC

CVE-2025-59528 Учебный PoC Только для образовательных целей. Этот проект предназначен для контролируемых исследований в области безопасности, учебных демонстраций и авторизованного тестирования в изолированной лаборатории. Не используйте его против систем, сетей, приложений или учётных записей,...

CVE-2026-25938-FUXA-Unauthenticated-RCE

CVE-2026-25938 - Неаутентифицированное RCE в FUXA 1. Что такое FUXA? FUXA — это бесплатная веб-платформа с открытым исходным кодом для SCADA Supervisory Control and Data Acquisition и HMI Human-Machine Interface, используемая для промышленной автоматизации , IoT и визуализации процессов в реально...

CVE-2026-104428

The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panics on verbosity 2 for a side-chain block because the block's -1 confirmations sentinel is converted to u32 with .expect, aborting the process. Remote unauthenticated attackers, directly or through...

CVE-2026-104427

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...

CVE-2026-104426

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remainingtransactionvalue that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactio...

CVE-2026-104427

Zebra versions before 6.1.0 are vulnerable to an incomplete cleanup vulnerability within the state write task . This flaw allows remote unauthenticated peers to stall node synchronization by poisoning the parent_error_map . Specifically, an attacker can deliver a coinbase-malleated block that sha...

EUVD-2026-91437

Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remainingtransactionvalue that clones the entire block-level spent-UTXO map per transaction during contextual verification. Attackers can mine or seed the mempool with roughly 26,000 minimal single-input transactio...

CVE-2026-104427 Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry

Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parenterrormap. Attackers can deliver a coinbase-malleated block sharing a canonical block's hash before it propagates, causi...

aztarna

Ce dépôt a été archivé et n'est plus maintenu. Reportez-vous à alurity pour les progrès futurs sur l'empreinte et l'identification des robots. aztarna Ce dépôt contient aztarna d'Alias Robotics, un outil d'empreinte pour robots. Alias Robotics soutient les fabricants de robots originaux dans...

CVE-2025-59528-POC

CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution CVSS 10.0 Critical | Blind RCE | FlowiseAI Flowise = 2.2.7-patch.1 and = 2.2.7-pa...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...