Drupalgeddon2-CVE-2018-7600

🔥 Drupalgeddon 2 Exploit — bixi.py 📖 Description bixi.py is an exploit for the CVE‑2018‑7600 Drupalgeddon 2 vulnerability affecting Drupal 7. It allows remote command execution RCE on vulnerable Drupal servers through an intuitive interface and predefined commands. ⚠️ DISCLAIMER / LEGAL NOTICE THI...

Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Summary registry/client.manifests.Getctx, dgst, … fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a...

GHSA-685W-Q87J-WQW3 Distribution: Client `manifests.Get()` does not verify returned content against requested digest

Summary registry/client.manifests.Getctx, dgst, … fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a...

soc-analyst-hub

🛡️ SOC Analyst Hub — Tier 1 Toolkit A free, fully offline interactive toolkit for Tier 1 SOC analysts — covering incident response, alert triage, threat hunting, and analyst onboarding. Zero dependencies. Single HTML file. Open in any browser. 🚀 Live Demo → 📦 What's Inside ⚡ Incident Response...

ThrottleStopPoC

ThrottleStopPoC CVE-2025-7771 : Arbitrary physical memory and I/O port read/write via ThrottleStop driver ThrottleStop is a small legitimate application used to monitor and correct CPU throttling. It has a driver that faciliates these tasks and it mostly doesn't have any sort of input validation...

security checks

🔍 Miner Hunter Crypto-miner detection, removal, and hardening toolkit for Linux servers. Built from real-world incident response — detects miners that hide from ps, top, htop, and btop using rootkit techniques. 📦 Installation git clone https://gitlab.com/abdom.seada/security-checks.git cd...

LSTAR-EN

LSTAR - Aggressor Translated to English! By Google Translate and Deepl For the purpose of simplifying CS right-click and facilitating self-integration, refer to a large number of post-infiltration plugins Refactored and enriched host-related credential acquisition, multi-level intranet penetratio...

GHSA-2X6F-RP82-PPMJ Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...

GHSA-P6WJ-QRR4-PGH5 kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...

kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items

Summary A nil-pointer dereference in openapi3filter lets any unauthenticated client crash a request handler with a single HTTP request against an OpenAPI 3.1 operation that declares type: array without items. OpenAPI 3.1 JSON Schema 2020-12 permits omitting items, and doc.Validate accepts such...

EUVD-2026-98911

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module...

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...

GHSA-V3PH-CGQH-R8P5 FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Summary In worker mode under concurrency, FrankenPHP can hand a PHP session id from one request to another when PHP's session extension is loaded as a shared module instead of being statically linked into the FrankenPHP binary. A request presenting Cookie: session=A can have sessionid resolve to ...

GHSA-CF23-7QXJ-XMHR Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...

Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Summary config.ValidateConfigFile is the security control that blocks dangerous nginx directives js, perl, loadmodule of njs/perl modules, user root. Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directive...

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

GHSA-5V7C-XPFP-P65M Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Reporter: Jagadesh Achanta Target: 0xJacky/nginx-ui Affected version / commit tested: - App version: 2.3.10 - Commit: 4948fba8744e82c3d7003f68ee164e9f49421066 - Disclosure channel: GitHub Private Vulnerability Reporting - Credential reference: cred:github-jagstack-gh-cli AI assistance disclosure...

Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...

GHSA-9JWW-CXG5-RJ9M Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Summary The MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that function and correctly rejects dangerous directives. An authenticated attacker c...