75 matches found
malicious-pdf
Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...
xzutils_backdoor_obfuscation
xzutilsbackdoorobfuscation 이 스크립트는 XZ utils 공격CVE-2024-3094에 사용된 난독화 기법을 재현합니다. xzutils v5.6.0에서만 테스트되었습니다. ⚠️ 이 코드는 교육 목적으로만 제공되며 악의적인 활동에 사용되어서는 안 됩니다. 사용에 따른 책임은 본인에게 있습니다. ⚠️ 사전 요구사항 작업 폴더에 xzutils 5.6.0의 원본 good-largecompressed.lzma 파일이 있어야 합니다. 사용법 다음을 실행하세요. ./obfuscatepayload.sh yourpayload...
CVE-2024-3094
CVE-2024-3094 악성 코드가 xz의 업스트림 tarball에서 5.6.0 버전부터 발견되었습니다. 일련의 복잡한 난독화를 통해 liblzma 빌드 프로세스는 소스 코드에 존재하는 위장된 테스트 파일에서 사전 빌드된 객체 파일을 추출하며, 이를 사용하여 liblzma 코드의 특정 함수들을 수정합니다. 그 결과, 이 라이브러리에 링크된 모든 소프트웨어에서 사용될 수 있는 수정된 liblzma 라이브러리가 생성되며, 이 라이브러리와의 데이터 상호 작용을 가로채고 수정합니다. 이 저장소에는 취약한 최신 버전의...
CVE-2026-18958 imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection
A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the...
SUSE CVE-2026-47429
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...
skopeo security update
1:1.22.2-6 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167688 1:1.22.2-5 - Rebuild for CVE-2026-25679 - Re-add test file installation to fix tier0 tests - Resolves: RHEL-158789...
CVE-2026-56342
AVideo
Missing Authorization
Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization through the api and browser.api request handlers in the server and UI components. An attacker can run tests, modify project files, or overwrite snapshots by connectin...
GHSA-5XRQ-8626-4RWP When Vitest UI server is listening, arbitrary file can be read and executed
Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network using --api.host or api.host config opti...
CVE-2026-9302
546669204 vps-inventory-monitoring (VpsTest Console) is affected via the VpsTest.php file’s eval usage. The vulnerability arises from manipulating the argument vf in the function eval, allowing remote code execution. Public exploit exists. The project uses a rolling release, and the CVE record do...
vps-inventory-monitoring 代码注入漏洞
vps-inventory-monitoring is a web inventory monitoring tool developed by individual developer 546669204. vps-inventory-monitoring has a code injection vulnerability, which stems from the use of the eval function in the VpsTest Console component file app/index/command/VpsTest.php, specifically...
WWBN AVideo 操作系统命令注入漏洞
WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained an operating system command injection vulnerability. This vulnerability stemmed from incomplete repairs in the test.php file, which did not clean up the...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an arbitrary code execution in Python-Future [CVE-2025-50817]
Summary IBM Watson Speech Services Cartridge is vulnerable to an arbitrary code execution in Python-Future, due to the unintended import of a file named test.py. CVE-2025-50817. Python-Future is used in our service runtimes. This vulnerabilitiy has been addressed. Please read the details for...
GHSA-45H5-66JX-R2WF MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827
MJML before 5.0.0-alpha.9 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...
SUSE SLED15 / SLES15 Security Update : python-future (SUSE-SU-2025:03049-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:03049-1 advisory. - CVE-2025-50817: Fixed arbitrary code execution via the automatic import of file test.py bsc1248124 Tenable has...
CVE-2025-67898
MJML through 4.18.0 allows mj-include directory traversal to test file existence and in the type="css" case read files. NOTE: this issue exists because of an incomplete fix for CVE-2020-12827...
CVE-2025-14673 gmg137 snap7-rs client.rs as_ct_write heap-based overflow
A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7rs::client::S7Client::asctwrite of the file /tests/snap7-rs/src/client.rs. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to t...
The vulnerability of the command_test.php script of the Core Config Manager component of the Nagios XI monitoring tool allows a hacker to execute arbitrary commands.
The vulnerability of the commandtest.php script of the Core Config Manager component of the Nagios XI monitoring tool is related to the failure to take measures to neutralize special elements used in the operating system’s commands when processing the address parameter. Exploiting this...
The vulnerability of the mm/kmsan/core.c and mm/kmsan/kmsan_test.c modules in the Linux operating system allows a hacker to cause a service failure.
The vulnerability in the mm/kmsan/core.c and mm/kmsan/kmsantest.c modules of the Linux operating system relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
