10264 matches found
frida v17.17.0
Frida Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers. Learn more at frida.re. Two ways to install 1. Install from prebuilt binaries This is the recommended way to get started. All you need to do is: root@kitploit: pip install frida-tools CLI tools pip...
Reverse-Lookup Service Exposed Millions of Photos of People’s Faces
The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...
MAL-2026-14194 Malicious code in system-performance-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...
Malicious code in system-performance-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f382b23398f0b2550e29a61c444b8dbd45796d20c938dead6ada9d967d82cabc Package advertises itself as a system performance monitoring helper, but its package.json declares a postinstall hook node install.js that opens a TC...
CVE-2026-67189: Improper Neutralization of Input During Web Page Generation
pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink...
PT-2026-78647
Name of the Vulnerable Software and Affected Versions pfSense Plus versions prior to 26.07 pfSense CE versions prior to 2.8.2 Description A stored cross-site scripting issue exists in the Traffic Graphs top-talkers feature. The system incorporates PTR records pointers used in reverse DNS lookups ...
SafeLine v9.4.0
SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋♂️ Discord | 中文版 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP...
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
The expensive attacks are not always the clever ones. This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was...
Budibase 3.31.4 Authentication Bypass / Remote Code Execution
Budibase versions through 3.31.4 contain an authentication and authorization bypass vulnerability that allows an unauthenticated remote attacker to access protected API endpoints by placing a webhook route pattern in the request query string. This proof of concept first verifies the bypass agains...
powershell-reverse-tcp v5.0
PowerShell Reverse TCP PowerShell scripts for communicating with a remote host. Remote host will have a full control over the client and all the underlying system commands. Check shells based on: Invoke-Expression PowerShell command here, process pipes here. Tested with PowerShell v5.1.19041.2673...
Exploit for CVE-2026-20896
CVE-2026-20896 - Gitea ≤1.26.2 Authentication Bypass 1. What...
bunkerweb testing
🌐 Website | 🤝 Panel | 📓 Documentation | 👨💻 Demo | 📱 Demo UI | 🧩 Templates | 🛡️ Examples 💬 Chat | 📝 Forum | 📝 Community | 🗺️ Threatmap | 📊 Status | 🔎 Feedback 🛡️ Make security by default great again! BunkerWeb BunkerWeb is a next-generation, open-source Web Application Firewall WAF. Being a...
Reversecore_MCP v3.0.3
Reversecore MCP AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through...
Malicious code in datefmt-core-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...
MAL-2026-14031 Malicious code in datefmt-core-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360a94a10ce13edded9e4a99c7c01de1ebfdd73a9af4ec49260f2cec165a609b The package advertises itself as a date-formatting utility but ships a postinstall.js that npm auto-executes on install via scripts.postinstall...
MAL-2026-14032 Malicious code in datefmt-simple-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9 datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fir...
Malicious code in datefmt-simple-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edc0c1f9cc25265504ab10c2634c3ea17e4028ff8412d4d7f4b22c41c33c3c9 datefmt-simple-utils presents itself as a date-formatting utility, but its package.json declares scripts.postinstall="node postinstall.js", which fir...
Malicious code in datefmt-util-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node...
MAL-2026-13978 Malicious code in datefmt-util-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node...
