CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92580 AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRF

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-5059-poc

¿Dónde está CVE-2026-5059 en el código? La vulnerabilidad está en dos archivos que trabajan juntos: Archivo 1: tools.py — La causa raíz La versión antigua usaba shell=True en executepipedcommand: root@kitploit: CÓDIGO ANTIGUO VULNERABLE process = subprocess.run command, ← cadena sin procesar pasa...

CVE-2026-64753

A flaw was found in WebKitGTK. Processing malicious web content can disclose sensitive user information due to a permission issue. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-serve...

CVE-2026-84635

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process termination due to improper state management. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

GO-2026-6451 webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd

webhookd: Unrestricted HTTP Header to Shell Variable Injection in github.com/ncarlier/webhookd...

CVE-2026-85756 SSH.NET: ScpClient allows server-side RCE via default SCP path handling

SSH.NET is a Secure Shell SSH library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an...

Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

MAL-2026-16228 Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

MAL-2026-16227 Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

MAL-2026-16225 Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

Malicious code in strapi-plugin-persh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ce68eeb9a309b5fff512e24a1b8f4c12fb171c0752d6a04293a4e72c805088 [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script spawns a...

MAL-2026-16237 Malicious code in strapi-plugin-persh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ce68eeb9a309b5fff512e24a1b8f4c12fb171c0752d6a04293a4e72c805088 [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script spawns a...

MAL-2026-16239 Malicious code in strapi-plugin-pysh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 188e8ecd93a0124135c178af848914dbd0f8cc7c3f9fdc7f5137fc94e46bb27d [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script uses...

Malicious code in strapi-plugin-perev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host...

MAL-2026-16236 Malicious code in strapi-plugin-perev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host...

Malicious code in strapi-plugin-ccip-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script...

MAL-2026-16226 Malicious code in strapi-plugin-ccip-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script...