macSubstrate

 macSubstrate - Substrato para macOS macSubstrate es una herramienta de plataforma para la inyección de código entre procesos en macOS, con una función similar a Cydia Substrate en iOS. Usando macSubstrate, puedes inyectar tus plugins .bundle o .framework en una app de macOS incluyendo apps en...

CVE-2018-6574

CVE-2018-6574 POC POC de exploit para CVE-2018-6574 Compilar 1. Crea un archivo de exploit con lo siguiente: root@kitploit: include include static void malicious attributeconstructor; void malicious system"COMMAND"; 2. Compílalo: root@kitploit: gcc -shared -o exploit.so -fPIC exploit.c 3...

CVE-2026-93337 NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

CVE-2026-93337 NetworkManager-l2tp Privilege Escalation via pppd Plugin Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...

CVE-2026-93337

NetworkManager-l2tp contains an improper input validation vulnerability in its handling of mru or mtu property values. A local user with VPN connection creation permissions can inject trailing non-numeric content after a valid integer, which is written verbatim into the pppd options file via writ...

CVE-2026-90938

LangBot's plugin runtime pip package langbotplugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugindebugkey, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

Oracle Linux 10 : vim (ELSA-2026-38509)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38509 advisory. - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186671 CVE-2026-52858 vim: possible code execution with...

Oracle Linux 8 : vim (ELSA-2026-38510)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-38510 advisory. - RHEL-186656 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave - RHEL-186648 CVE-2026-52858 vim: possible code execution with...

Updated vim packages fix security vulnerabilities

Heap Buffer Overflow in spell file loading affects Vim 9.2.0450. CVE-2026-45130 Vimscript Code Injection in netrw NetrwMarkFile via crafted filename affects Vim 9.2.0480. CVE-2026-43961 Command Injection in tar.vim affects Vim 9.2.0479. CVE-2026-46483 Vimscript Code Injection in netrw...

CLSA-2026-1779912818 Fix CVE(s): CVE-2026-42307

SECURITY UPDATE: OS command injection in the netrw plugin via crafted sftp:// or file:// URLs - debian/patches/CVE-2026-42307.patch: OS command injection in the netrw plugin via crafted sftp:// or file:// URLs - CVE-2026-42307...

spamassassin: Fix of CVE-2018-11805

CVE-2018-11805: require --reallyallowplugins for sa-update --allowplugins to mitigate plugin injection from updates...

CLSA-2026-1777548877 spamassassin: Fix of CVE-2018-11805

CVE-2018-11805: require --reallyallowplugins for sa-update --allowplugins to mitigate plugin injection from updates...

CLSA-2026-1777548876 spamassassin: Fix of CVE-2018-11805

CVE-2018-11805: require --reallyallowplugins for sa-update --allowplugins to mitigate plugin injection from updates...

Oracle Linux 8 : vim (ELSA-2026-11509)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-11509 advisory. - RHEL-159620 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob function - RHEL-155428 CVE-2026-28417 vim: Vim: Arbitrary code...

EUVD-2021-1385

Malware in sbrugna...

CVE-2024-28236

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string...

URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header

Description The plugin does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link. PoC 1. Add a new shortened link in the interface...

WordPress wpgform plugin injection vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. wpgform is used in one of the Google form to add plug-ins . WordPress wpgform plugin has an injection vulnerability, no...

Discuz7. 2 of my vest plug-injection vulnerability-a vulnerability warning-the black bar safety net

Discuz! A common set of community forums software system, the user can not require any programming on the basis of, through the simple setup and installation, on the Internet build up with perfect function, strong load capacity, and highly customizable Forum service Vulnerability plug-in:...