LFISuite

LFI Suite What is LFI Suite? LFI Suite is a totally automatic tool able to scan and exploit Local File Inclusion vulnerabilities using many different methods of attack, listed in the section Features. Features Works with Windows, Linux and OS X Automatic Configuration Automatic Update Provides 8...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

CVE-2014-2383-LFI-to-RCE-Escalation

CVE-2014-2383 LFI/RFI escalation to RCE Testing environment: dompdf 0.6.0 - php 7.3.33 - apache 2.4.25 During a security assessment the presence of CVE-2014-2383 was discovered. This document is a proof of concept and does not include the details from the initial discovery in order to protect...

CVE-2024-28397-Js2Py-RCE

CVE-2024-28397 - Js2Py Sandbox Escape Payload Generator This script generates a JavaScript payload that can be evaluated by Js2Py in vulnerable environments where Python internals are exposed through object wrappers. Usage Basic command execution: python3 cve-2024-28397.py -c "id" Generate a...

CVE-2026-113722

A flaw was found in virtualenv. Due to improper quoting of interpreter paths when generating script wrappers, an attacker who influences the environment destination path can achieve arbitrary code execution. When a user subsequently executes a generated script launcher, embedded shell commands ar...

CLSA-2026-1792520497 TuxCare security update for @babel/helper-skip-transparent-expression-wrappers (2 CVEs)

TuxCare rebuilt @babel/helper-skip-transparent-expression-wrappers to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792520495 TuxCare security update for @babel/helper-skip-transparent-expression-wrappers (1 CVE)

TuxCare rebuilt @babel/helper-skip-transparent-expression-wrappers to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792520492 TuxCare security update for @babel/helper-skip-transparent-expression-wrappers (1 CVE)

TuxCare rebuilt @babel/helper-skip-transparent-expression-wrappers to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792520491 TuxCare security update for @babel/helper-skip-transparent-expression-wrappers (1 CVE)

TuxCare rebuilt @babel/helper-skip-transparent-expression-wrappers to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

Astra Linux – Vulnerability in Firefox and Thunderbird

Cross-compartment wrappers used to wrap a scripted proxy might have caused objects from other compartments to be stored in the main compartment, resulting in a “use-after-free” vulnerability. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...

Astra Linux – Vulnerability in Thunderbird, Firefox

Cross-compartment wrappers used to wrap a scripted proxy might have caused objects from other compartments to be stored in the main compartment, resulting in a “use-after-free” error after unwrapping the proxy. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

injectorkit

InjectorKit 简体中文 · English · GuideGUIDE...

CVE-2026-98220

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scxbpfselectcpuand and scxbpfdsqinsertvtime refuse the call and report to @p's scheduler:...

[SECURITY] Fedora 45 Update: libgdamm-4.99.11-26.fc45

C++ wrappers for libgda. libgdamm is part of a set of powerful C++ bindings for the GNOME libraries, which provide additional functionality above GTK+/gtkmm...

CVE-2026-79913 Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, and 6to4 IPv4-in-IPv6 transition forms. An authenticated...

askbob (>=0.0.3, <=0.0.4), cde (0.2.0.1) +12 more potentially affected by CVE-2026-85078 via sanic (20.9.0)

sanic PYPI version 20.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - askbob =0.0.3, =0.0.19, =0.1.1, =0.3.26, =0.10.25, =2.2.10, =0.0.1, =0.2.1, =0.2.2 - sanic-sockjs 0.1.0 - sstool-general 0.0.4 - vma-nlu 1.1.6 Source...

GHSA-2XMM-M4WV-3FJH October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

October CMS: Incomplete Scheme Validation in Image Resizer

The image resizer classified external sources by testing whether the source string began with the substring http, and the string-source branch in ResizeImageItem::fromObject accepted any value containing :// as a URL. As a result, non-https PHP stream wrappers such as phar://, file:// and ftp://...

CVE-2026-85485

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...

DEBIAN-CVE-2026-85485

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent...