fuxploider

fuxploider Fuxploider è uno strumento di penetration testing open source che automatizza il processo di rilevamento e sfruttamento delle vulnerabilità dei form di upload di file. Questo strumento è in grado di rilevare i tipi di file consentiti per l'upload e di determinare quale tecnica funzione...

emacs security update

1:26.1-15.2 - Fix TRAMP user name shell injection vulnerability CVE-2026-79992 - Resolves: RHEL-248545 1:26.1-15.1 - Fix integer overflow in PBM image loader CVE-2026-77219 - Resolves: RHEL-248064...

vulnx

VulnX Vulnx 🕷️ es un Bot Inteligente Auto Inyector de Shell que detecta vulnerabilidades en múltiples tipos de CMS https://github.com/anouarbensaad/vulnx/archive/master.zip Wiki de VulnX • Cómo Usar • Compatibilidad • Biblioteca • Vulnx es un Bot Inteligente Auto Inyector de Shell que detecta...

xiaomi15-dada-cve-2026-64560

Xiaomi 15 dada CVE-2026-64560 Adattamento specifico per dispositivo del proof of concept Android NebuSec CVE-2026-64560 per una build esatta di Xiaomi 15. Fornisce accesso root temporaneo per il boot corrente tramite un helper accessibile solo da ADB shell. !WARNING Questo è codice sperimentale d...

CVE-2026-108593

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and...

p0wny-shell

p0wny@shell: -- Shell PHP monofile p0wny@shell: è una shell PHP monofile molto basilare. Può essere usata per eseguire rapidamente comandi su un server quando si esegue il pentesting di un'applicazione PHP. Usala con cautela: questo script rappresenta un rischio per la sicurezza del server...

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

UBUNTU-CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are...

Malicious code in @library-wide/library-shell (npm)

Source: ossf-package-analysis 40f52e7af5c6b8f0c78b5100b561b799fc6acd9fa9c5372982a14bb5c1b42da1 The OpenSSF Package Analysis project identified '@library-wide/library-shell' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

redpill

:octocat: Descrizione del Progetto Il progetto redpill mira ad assistere le shell TCP inverse nei compiti di post-esplorazione. Spesso, negli incarichi redteam, abbiamo bisogno di usare modi non convenzionali per accedere al sistema target, come le shell TCP inverse non metasploit per bypassare l...

fix-react2shell-next

fix-react2shell-next Un comando per risolvere CVE-2025-66478 React 2 Shell RCE nella tua app Next.js / React RSC. npx fix-react2shell-next Aggiornamenti di versione deterministici secondo gli advisory ufficiali. Cosa fa 1. Scansiona ricorsivamente tutti i file package.json gestisce monorepo 2...

CVE-2026-101947 ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

dirtycow-vdso

0xdeadbeef PoC para Dirty COW CVE-2016-5195. Este PoC se basa en ptrace en lugar de /proc/self/mem para parchear vDSO. Tiene algunas ventajas sobre los PoCs que modifican binarios del sistema de archivos: no requiere un binario setuid bypass de SELinux escape de contenedores sin caída del kernel...

CLEANSTART-2026-VG90547 shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token

Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...

PT-2026-117880

Security vulnerability affects the n8n package. shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token...

CVE-2026-101947: Improper Neutralization of Special Elements used in an OS Command

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload vulnerability in the temporaryFileUploads parameter. The proof of concept uploads a GIF/PHP polyglot, writes it with a .php extension, and verifies command execution...

zip-shotgun

ZIP Shotgun Script utility per testare la funzionalità di upload di file zip e la possibile estrazione di file zip per vulnerabilità alias Zip Slip. L'idea per questo script proviene da questo post su Silent Signal Techblog - Compressed File Upload And Command Execution e da OWASP - Test Upload o...