exploit-CVE-2016-9920

Roundcube 1.0.0 = 1.2.2 Remotecodeausführung Roundcube ist eine weit verbreitete Open-Source-Webmail-Software, die von vielen Organisationen und Unternehmen auf der ganzen Welt genutzt wird. Der Spiegel auf SourceForge beispielsweise zählt allein in den letzten 12 Monaten mehr als 260.000...

EUVD-2026-67328

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

eBPF-hid_guard

eBPF-hidguard Siehe unten Warum dies archiviert wurde. Ein Linux-Kernel-Space-Sicherheitsmonitor zur Erkennung und Blockierung von HID-Injektionsangriffen Rubber Ducky, O.MG Cable, ESP32-basierte Tastaturemulatoren mittels eBPF HID-BPF structops. Was dies tut Bösartige HID-Geräte emulieren...

hermes

Hermes Hermes ist ein leichtgewichtiger Linux-Agent, geschrieben in Python, entwickelt für Mythic 3.0 und neuer. Benannt nach Hermes, dem Götterboten – entwickelt für Geschwindigkeit und Diskretion. Funktionen Linux-Unterstützung SOCKS5-Proxy-Unterstützung für Pivoting und laterale Bewegung Mehre...

CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-75417

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

TPASLog4ShellPoC

TPAS Log4Shell PoC Dieses Repository enthält einen Proof of Concept PoC für die Log4Shell-Schwachstelle CVE-2021-44228, der im Rahmen der Lehrveranstaltung TPAS des Masterstudiengangs Informationssicherheit an der FCUP entwickelt wurde. Es umfasst: Ein React SPA Frontend, das eine generische...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-38822

In openNDS before 11.0.0 , the client_params.sh script—invoked by the openNDS daemon to serve the authenticated client status page—is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embed...

EUVD-2026-67362

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2021-32537

CVE-2021-32537: Zugriff außerhalb des zulässigen Bereichs in RTKVHD64 führt zu Pool-Korruption. Dies ist ein Fehler, den ich Anfang April 2021 bei Realtek gemeldet habe. Der betroffene Treiber heißt RTKVHD64.sys und scheint auf einer Reihe von Mainstream-Hardware verfügbar zu sein getestet wurden...

CVE-2026-38820

openNDS versions before 11.0.0 are susceptible to unauthenticated OS command execution due to a shell command injection vulnerability in libopennds.sh . The flaw is triggered through the fas query parameter on the /opennds_preauth/ endpoint, allowing an attacker on an adjacent network to execute ...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

EUVD-2026-67360

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...

CVE-2026-38820

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /openndspreauth/ endpoint because of libopennds.sh...