security_monkey

NOTE: Security Monkey is in maintenance mode and will be end-of-life in 2020. For AWS users, please make use of AWS Config. For GCP users, please make use of Cloud Asset Inventory. Security Monkey Security Monkey monitors your AWS and GCP accounts for policy changes and alerts on insecure...

KisMac2

PLEASE NOTE, THIS PROJECT IS NO LONGER BEING MAINTAINED KisMac2 KisMAC is a free, open source wireless stumbling and security tool for Mac OS X. Issue tracking: Going forward, please use the tracker here on GitHub. The Trac for the original KisMac is at http://trac.kismac-ng.org Whats new:...

POC-CVE-2026-0300-exploit

CVE-2026-0300 — Explotación de desbordamiento de búfer en el Portal de Autenticación User-ID de PAN-OS Crítico CVSS 9.3 — Ejecución remota de código no autenticada en el Portal Cautivo de PAN-OS de Palo Alto Networks Tabla de Contenidos Descripción General Detalles de la Vulnerabilidad Versiones...

FORTIWEB_CVE-2025-64446-58034

FortiWeb Exploit Simulation CVE-2025-64446 & CVE-2025-58034 Note: This document is for educational and security research purposes only. Do not use to attack systems without authorization. 1. Overview FortiWeb is a Web Application Firewall WAF device used to protect web applications. In 2025, two...

gdbfuzz

GDBFuzz: Debugger-Driven Fuzzing This is the companion code for the paper: 'Fuzzing Embedded Systems using Debugger Interfaces'. A preprint of the paper can be found here https://publications.cispa.saarland/3950/. The code allows the users to reproduce and extend the results reported in the paper...

IoT-PT-v1

🛠️ IoT-PT OS v1 Internet of Things Penetration Testing OS - Version 1 📦 What is IoT-PT OS v1? IoT-PT OS v1 is a penetration testing virtual machine designed specifically for IoT security assessments. It includes pre-configured tools, scripts, and environments tailored for firmware analysis,...

openclarity

OpenClarity is an open source tool for agentless detection and management of Virtual Machine Software Bill Of Materials SBOM and security threats such as vulnerabilities, exploits, malware, rootkits, misconfigurations and leaked secrets. Join OpenClarity's Slack channel to hear about the latest...

EUVD-2026-75766

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

EUVD-2026-75769

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-75765

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-75774

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

EUVD-2026-75794

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

CVE-2026-26832

CVE-2026-26832: node-tesseract-ocr 中的操作系统命令注入 摘要 node-tesseract-ocr 至版本 2.2.1 允许在 src/index.js 的 recognize 中进行操作系统命令注入。该包构建一个 shell 命令字符串并使用 childprocess.exec 执行它。由于输入路径仅用双引号包裹，攻击者可以通过精心构造的文件路径注入 shell 语法。 受影响产品 产品| 受影响版本| 修复版本 ---|---|--- node-tesseract-ocr| 所有 2.2.1 及之前版本| 截至 2026-03-24 无可用修复...

Ubiquiti UniFi OS Server < 5.1.37 Multiple Vulnerabilities

The version of Ubiquiti UniFi OS Server installed on the remote host is prior to 5.1.37. It is, therefore, affected by multiple vulnerabilities: - A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability fou...

CVE-2021-27928

CVE-2021-27928 En este repositorio, encontrarás una prueba de concepto de la explotación de la vulnerabilidad CVE-2021-27928 a través de un contenedor docker. root@kitploit: Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec...

CVE-2020-8958

针对 CVE-2020-8958 的概念验证脚本，使用 Python 编写。如果成功，脚本将返回 /etc/passwd 的内容。 CVE-2020-8958 广州 1GE ONU V2801RW 1.9.1-181203 至 2.9.0-181024 以及 V2804RGW 1.9.1-181203 至 2.9.0-181024 设备允许远程攻击者通过在 boaform/admin/formPing 的目标 IP 地址字段中使用 shell 元字符来执行任意操作系统命令。 要求 Python 3.X bs4 使用方法 python poc.py...

CVE-2026-26830

CVE-2026-26830: Inyección de comandos del sistema operativo en pdf-image Resumen pdf-image a través de la versión 2.0.0 permite la inyección de comandos del sistema operativo mediante el argumento pdfFilePath. El paquete construye cadenas de comandos shell con util.format y las ejecuta con...

CVE-2026-17176 OS command injection Vulnerability in Deco BE11000

An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution...

CVE-2026-17176

TP-Link Deco BE11000 is affected by an OS command injection vulnerability in its TDDP module . An attacker on the adjacent network can exploit this by sending a crafted UDP packet , executing arbitrary commands with root privileges without any prior authentication. Successful exploitation may lea...

CVE-2025-61304

CVE-2025-61304 Dynatrace ActiveGate ping扩展（版本1.016及以下）中通过精心构造的IP地址存在的OS命令注入漏洞 在后台，ping扩展使用Windows命令提示符来执行ping操作。测试目标主机的输入字段长度为1024个字符。在IP地址之后，只需使用'&'即可写入额外命令供ActiveGate执行。 已向Dynatrace报告，并通过此提交修复： https://github.com/Dynatrace/dynatrace-api/pull/99 利用RCE添加用户： 本地用户列表前后对比： 其他示例载荷： 1...