CVE-2026-88859

CVE-2026-88859 is a flaw in the Evolution email client where a remote attacker can send a crafted HTML email containing a spoofed vCard control . When the victim clicks it, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source , res...

CVE-2026-88859

A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a specially crafted HTML email containing a spoofed vCard control. When a victim clicks on this control, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to a...

react2shell-audit

Auditoría React2Shell CVE-2025-55182 React2Shell Audit es un script Bash ligero y recursivo diseñado para detectar instalaciones locales de Next.js y React Server DOM vulnerables a CVE-2025-55182 React2Shell y CVE-2025-66478. 🚨 La Vulnerabilidad React2Shell es una vulnerabilidad crítica de...

CVE-2017-12542

CVE-2017-12542 This script checks if an HP iLO server is vulnerable and can add an admin user...

CVE-2025-32463

Sudo version 1.9.17 has a critical vulnerability CVE-2025-32463 that allows local users to gain root access by exploiting the chroot option, which can lead to serious security risks. Users are advised to update to version 1.9.17p1 or later to mitigate this issue. Overview of the Sudo 1.9.17...

CVE-2025-55182

简体中文 | English This is an analysis, validation environment, and POC repository for CVE-225-55182 vulnerability. Learn the Vulnerability See this article 《CVE-2025-55182 Analysis.md》. Verify the vulnerability After setting up the test or debugging environment, run the script poc.py. If a calculato...

Elysium-Vanguard-Sentinel-Audit

SENTINEL-ROOT-AUDIT: Honor Magic V2 虚拟机监控器检测套件 ➲ 项目概述 SENTINEL-ROOT-AUDIT 是一款专业级安全套件，旨在审计内核完整性并检测针对 Honor Magic V2 SM8550 的虚拟机监控器级干预。 虽然核心漏洞（CVE-2025-38352）允许在内核中实现 OOB 读/写 原语，但本套件侧重于“纵深防御”方面——展示现代硬件级保护（EL2 RKP）如何成功挫败利用尝试。 ⚡ 关键特性 利用逻辑（阶段4） ：功能性独立PoC，展示内核内存读取。 KASLR 绕过 ：通过驱动程序信息泄露进行实时偏移计算。 隐身监视器...

CVE-2024-46982-Reproduction

开始使用 1. 安装 Node.js LTS 2. npm install 3. npm run build 4. npm run start 利用方法 1：通过缓存投毒实现存储型 XSS 1. 使用任意 HTTP 客户端发送以下 HTTP 请求（攻击请求）。 root@kitploit: GET /poc?nextDataReq=1 HTTP/1.1 Host: localhost:3000 User-Agent: alert'XSS' x-now-route-matches: 1 2. 使用任意 Web 浏览器访问 http://localhost:3000（正常请求）。 利用方法...

CVE-2013-0156

Rails YAML deserialization RCE CVE-2013-0156 - PentesterLab Compatible Ronin-free, Ruby 3.x compatible version of https://gist.github.com/postmodern/4499206 Usage: ruby railsrce.rb http://target/ "system'/usr/local/bin/score UUID'" ⚠️ LEGAL DISCLAIMER ⚠️ This script is for EDUCATIONAL PURPOSES ONLY...

hermes-decomp v0.2.3

Rust decompiler for Hermes bytecode .hbc, the JS engine behind React Native. Supports HBC 40 to 99. Install Pre-built binaries Linux / macOS / Windows from Releases or Actions: Asset suffix| Platform ---|--- linux-x8664 / linux-arm64| Linux macos-arm64 / macos-x8664| macOS windows-x8664| Windows...

Security Bulletin: Multiple vulnerabilities affects IBM Db2 Big SQL on IBM Software Hub

Summary Multiple vulnerabilities affects IBM Db2 Big SQL on IBM Software Hub 5.4 and earlier. Vulnerability Details CVEID:CVE-2026-53655 DESCRIPTION: node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter 是一款高级 Python 工具，专为安全研究人员设计，用于自动检测客户端 JavaScript 中硬编码的机密信息。 与简单扫描器不同，V2 包含一个动态爬虫，它会解析目标网站的 HTML，自动提取所有已加载的 JavaScript 文件，从而确保全面覆盖。 功能 🕷️ 动态爬取：解析 HTML，自动查找所有 标签。 🔍 基于正则的检测：识别私钥、API 令牌、AWS 密钥和数据库凭据。 📂 混合扫描：将动态爬取与常见敏感文件名字典相结合（例如 config.js）。 🛡️ 安全：仅进行被动扫描。 安装...

Malicious code in extremophile-venus-neptune-run-script (npm)

The package extremophile-venus-neptune-run-script was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in express-mongo-santi (npm)

Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose is a remote-fetch-and-execute pipeline that fires when the...

Malicious code in express-middle (npm)

Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-style RC4-decoded 344-entry string array with control-flow...

Malicious code in exoplanet-string-bulma-tardigrade (npm)

Source: amazon-inspector 3db6d30965032b31e8676816820d7bbeb491cca49937b3702c7436d896a3b8df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in exec-concurrently-run-script-pm2 (npm)

The package exec-concurrently-run-script-pm2 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ethereum-sign-utils (npm)

Source: amazon-inspector a6f2998ee6903e6a20b55e371b8b074fb130d3e4c6f6d489999fd61f7e536673 On npm install, the package's postinstall script node postinstall.js, declared in package.json scripts.postinstall reads installer-side secret files including.env variants, /.npmrc, /.aws/credentials,...

Malicious code in eslint-config-sirius-run-script-sublimation (npm)

Source: amazon-inspector 78a80afbce79edd35b6742c49c7370920da3f1a0237ff091da1314fd7828be10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in entropyeasybots (npm)

Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111, granting remote shell access on the installer's host...