CVE-2026-27574-OneUptime-RCE

CVE-2026-27574-OneUptime-RCE Обзор Эксплойт Proof-of-Concept для CVE-2026-27574 — критической уязвимости внедрения кода CWE-94 в OneUptime BOpen Registr...

CVE-2026-28372-GNU-inetutils-telnetd-Privilege-Escalation

CVE-2026-28372 — Повышение привилегий в GNU inetutils telnetd — PoC 👤 Автор Mohammed Idrees Banyamer Иордания 🇯🇴 Instagram: @banyamersecurity Исследователь безопасности | Наступательная безопасность | Разработка эксплойтов 🧨 Название эксплойта CVE‑2026‑28372 — Повышение привилегий в GNU inetutils...

CVE-2026-24061-GNU-Inetutils-telnetd-Remote-Authentication-Bypass-Root-Shell-

🧨 Обзор Этот репозиторий содержит эксплойт Proof‑of‑Concept для уязвимости удалённого обхода аутентификации в GNU Inetutils telnetd. Проблема возникает из-за того, что telnetd некорректно обрабатывает переменную окружения USER , полученную через Telnet‑согласование NEW‑ENVIRON , перед вызовом...

inetutils-telnetd-auth-bypass

inetutils-telnetd auth bypass lab, CVE-2026-24061 A small lab to play with the auth bypass in inetutils-telnetd 1.9.3 - 2.7 as disclosed on the oss-sec mailing list. 0 This container relies on the fact that inetutils-telnetd is still a vulnerable version in Debian 11 Bullseye. At the time of...

CVE-2021-4034_POC

CVE-2021-4034 - Proof Of Concept This POC exploits GLib 's gprinterr to leverage code execution through the injection of the GCONVPATH environmental variable. Running the exploit Make a tarball file of the exploit: make tar Then somehow transfer the generated tar to the target machine, compile, a...

CVE-2023-22527_Confluence_RCE

CVE-2023-22527 Confluence RCE CVE-2023-22527 — уязвимость удаленного выполнения кода RCE в Confluence Data Center и Confluence Server PoC Ссылки CVE-2023-22527 — уязвимость удаленного выполнения кода RCE в Confluence Data Center и Confluence Server | Atlassian Support | Atlassian Documentation...

CVE-2026-24061-PoC-Telnetd

CVE-2026-24061 Proof of Concept PoC ⚠️ DISCLAIMER: EDUCATIONAL PURPOSES ONLY ⚠️ This repository contains a Proof-of-Concept PoC exploit for CVE-2026-24061. It is intended strictly for educational purposes and for testing systems in a controlled lab environment. The author takes no responsibility...

CVE-2026-24061

CVE-2026-24061: telnetd Authentication Bypass Vulnerability CVE-2026-24061 is an authentication bypass vulnerability in telnetd that allows attackers to bypass identity verification through specific combinations of environment variables and directly obtain a root-privileged shell. There is a flaw...

CVE-2026-24061

CVE-2026-24061 - Telnet Argument Injection Nuclei template for detecting the CVE-2026-24061 vulnerability in GNU inetutils telnetd, allowing root access without authentication. 📋 Vulnerability Description CVE-2026-24061 is a critical argument injection vulnerability in GNU inetutils telnetd that...

CVE-2026-24061

GNU InetUtils telnetd Authentication Bypass via Argument Injection - CVE-2026-24061 📚 Introduction A recently identified argument injection vulnerability in GNU InetUtils telnetd allows attackers to circumvent authentication by setting the USER environment variable to the value “-f root”. As a...

GNU-Inetutils-telnet-CVE-2026-24061-

CVE-2026-24061 GNU Inetutils Telnetd Authentication Bypass Vulnerability Detection Tool 📋 Project Overview This is an advanced detection tool for the GNU Inetutils Telnetd authentication bypass vulnerability CVE-2026-24061. This vulnerability has a CVSS score of 9.8, allowing attackers to obtain...

CVE-2026-24061-NSE

CVE-2026-24061 — GNU InetUtils telnetd Authentication Bypass Nmap NSE Detection Script Overview This Nmap NSE script detects CVE-2026-24061 , an authentication bypass vulnerability in GNU InetUtils telnetd versions 1.9.3 through 2.7. By sending a crafted USER environment variable of the form -f...

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

ImpactUsers of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Serverless Function Environment Variable Injection via Event Program Code Python Lambda sim lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environment variable overrides debug feature for key, value...

CVE-2024-50340

CVE-2024-50340 POC Requirements The registerargcargv option must be enabled in the PHP configuration file php.ini. This setting loads command-line arguments and query params into $SERVER'argv'. https://www.php.net/manual/en/ini.core.phpini.register-argc-argv Explanation of Vulnerable Code This...

CVE-2024-48990

CVE-2024-48990 Введение Эта уязвимость использует способ, которым needrestart управляет переменными окружения; точнее, PYTHONPATH можно перехватить, изменив переменную PYTHONPATH на каталог, содержащий вредоносную библиотеку, что позволяет выполнить код и получить доступ. В некоторых каталогах...

CVE-2024-28397-js2py-Sandbox-Escape

CVE-2024-28397-js2py-Sandbox-Escape js2py Vulnerability Analysis Introduction js2py is a popular python package that can evaluate javascript code inside the python interpreter. It is used by various web scrapers to parse javascript code on websites. There exists a vulnerability in the...

CVE-2024-48990-PoC

CVE-2024-48990-PoC What is needrestart and how does it work? Needrestart is a widely used utility on Linux systems default on many Ubuntu versions that checks after a software update whether any service or the system itself needs to be restarted. By analyzing running processes, it determines if...

CVE-2024-46538

Thanks tophysicszq, who discovered this vulnerability. CVE-2024-46538 ★ CVE-2024-46538 PfSense Stored XSS lead to Arbitrary Code Execution PoC ★ Description CVE-2024-46538 : PfSense Stored XSS Vulnerability description: A cross-site scripting XSS vulnerability in pfsense v2.5.2 allows attackers t...

CVE-2025-27363-proof-of-concept

Proof-of-concept for CVE-2025-27363 that crashes FreeType 2.13.0. This modifies Roboto Flex, a variable font, so that the "%" character glyph 8 is now a composite glyph with 0xfffd subglyphs. Rendering the edited font with FreeType 2.13.0 the last version before the fix crashes, with ASAN detecti...