sh4d0wup

sh4d0wup % docker run -it --rm ghcr.io/kpcyrd/sh4d0wup:edge -h Usage: sh4d0wup OPTIONS Commands: bait Start a malicious update server front Bind a http/https server but forward everything unmodified infect High level tampering, inject additional commands into a package tamper Low level tampering,...

eclipse__hawkbit_CVE-2020-27219_0-3-0M6

Eclipse hawkBit™ - Serveur de mise à jour Eclipse hawkBit est une solution back-end indépendante du domaine pour déployer des mises à jour logicielles sur des appareils contraints en périphérie ainsi que sur des contrôleurs et passerelles plus puissants connectés à une infrastructure réseau basée...

sjcam

Lelouch : Recherche sur le firmware SJCAM SJ4000 et firmware personnalisé Trocar para Português Brasil Notes de rétro-ingénierie, outils pour le firmware, code de preuve de concept et une interface de firmware personnalisé pour la version Allwinner V3 du SJCAM SJ4000 Air. Article de recherche Ce...

WPS-CVE-2022-24934

Предупреждение ЭТА ПРОГРАММА ИСПОЛЬЗУЕТ GENERIC, ВВЕДЁННЫЙ В GO 1.18. ОБНОВИТЕ ВАШ КОМПИЛЯТОР! CVE-2022-24934 Веб-сервер для эксплуатации этой уязвимости с помощью wpsupdate.exe Поддельный сервер обновлений WPS PoC Только для исследовательских целей. Загрузка файла Установите файл, который хотите...

CVE-2022-24934

CVE-2022-24934 취약점 개요 WPS Office 업데이트 프로그램 wpsupdate.exe는 레지스트리 HKEYCURRENTUSER에서 사용자 지정 업데이트 서버 주소를 읽어 사용자 지정 업데이트 프로그램을 다운로드하고 실행하므로 임의 코드 실행이 발생합니다. 영향 범위 WPS Office 11.2.0.10382 이하 모든 버전은 이 취약점의 영향을 받습니다. （WPS 버전 번호는 마지막 그룹을 확인하면 됩니다. 마지막 그룹의 숫자가 클수록 최신 버전이며, 11.1은 개인용, 11.2는 기업용, 11.6과 11.8은...

WPS-CVE-2022-24934

SOUTENEZ L'UKARINE Poutine EST CRIMINEL ! Avertissement CE PROGRAMME UTILISE GENERIC QUI A ÉTÉ INTRODUIT DANS GO 1.18, METTEZ À JOUR VOTRE COMPILATEUR ! CVE-2022-24934 Serveur Web pour exploiter cette vulnérabilité en utilisant wpsupdate.exe Serveur de mise à jour WPS factice - PoC Usage à des fi...

CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73533

CVE-2026-73533 affects Ninja Tables Pro 5.2.11. The vulnerability is an embedded malicious code issue introduced via a tampered plugin build served through a decommissioned update server. A rogue file, app/Library/updater/NinjaTableDataSync.php, creates a backdoor REST API endpoint and drops pers...

EUVD-2026-54200

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032 Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032 Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-17032

CVE-2026-17032 concerns Supsystic Multiple Pro Plugins. The issue arises from a vendor update server compromise, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and sensitive data and grants full control of affected sites. The records indicate a cr...

CVE-2026-17032: Hidden Functionality

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites...

CVE-2026-10849: Heap-based Buffer Overflow

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

CVE-2026-12375 Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator sessio...

CVE-2026-12375 Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator sessio...

CVE-2026-10735

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

EUVD-2026-38693

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

CVE-2026-10735 ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...