7065 matches found
A Practical Memory Injection Attack against LLM Agents
In this whitepaper, the authors propose a novel Memory INJection Attack, MINJA, that enables the injection of malicious records into the memory bank by only interacting with the agent via queries and output observations...
WordPress GPX Viewer 2.2.8 Arbitrary File Creation
WordPress GPX Viewer plugin versions 2.2.8 and below suffer from an arbitrary file creation vulnerability...
Creating Scripts to Identify Vulnerable FTPs
This whitepaper covers how to create Nmap scripts to identify banners and versions of FTP servers. It also covers methods to mitigate the public visibility of banners and version information on FTP servers. Written in Portuguese...
How to Create a Scan for Server-Side Request Forgery
This whitepaper covers how to create a scan in Perl to identify server-side request forgery in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid SSRF problems at the cod...
How to Create a Scan to Identify Remote Command Execution
This whitepaper covers how to create a scan in Perl to identify remote command execution in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid RCE problems at the code...
How to Create a Scan to Identify Remote File Inclusion
This whitepaper covers how to create a scan in Perl to identify remote file inclusion in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid remote file inclusion problems...
Proxyrack Global Cybercrime Report 2025
This report delves into the key trends, statistical insights, and geographical impacts of cybercrime, while exploring attack vectors and the industries and regions most affected...
cvp Incorrect Bailout Use-After-Free
In the function msmcvpmapbufwncc reachable from the EVAKMDREGISTERBUFFER ioctl, after cbuf is created and fully initialized, it is unconditionally added to the linked list inst-cvpwnccbufs.list. msmcvpmapbufwncc then tries to add an entry for the buffer to inst-cvpwnccbufstable. This can fail if...
How to Create a Scan to Identify Command Injection
This whitepaper covers how to create a scan in Perl to identify remote code injection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid remote code injection problems...
Firefox txMozillaXSLTProcessor Use-After-Free
There is a use-after-free vulnerability in Firefox in txMozillaXSLTProcessor. The vulnerability was reproduced with an ASAN build from the latest source code...
How to Create a Scan for Path Traversal
This whitepaper covers how to create a scan in Perl to identify path traversal in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid path traversal problems at the code...
How to Create a Scan for Open Redirects
This whitepaper covers how to create a scan in Perl to identify open redirection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid open redirect problems at the code...
How to Create a Scan for Local File Inclusion
This whitepaper covers how to create a scan in Perl to identify different types of local file inclusion in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid local file...
How to Create a Scan to Identify Reflected XSS
This whitepaper covers how to create a scan in Perl to identify reflected cross site scripting in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid reflective cross site...
Linux FUSE Use-After-Free
There is a use-after-free read in FUSE, basically hittable without racing, that copies freed kernel memory read through an outdated dname pointer to userspace...
How to Create a Scan for SQL Injection
This whitepaper covers how to create a scan in Perl to identify different types of SQL injection in web applications. Depending on the context of the environment and architecture, the content of the paper can be applied to APIs in addition to presenting how to correct or avoid SQL injection...
Packet Storm New Exploits for February, 2025
This archive contains all of the 79 exploits added to Packet Storm in February, 2025...
JSONPath-plus Remote Code Execution
JSONpath-plus versions prior to 10.3.0 are vulnerable to a remote code execution vulnerability due to improper input sanitization. This is due to an incomplete fix for CVE-2024-21534...
WordPress ACF City Selector 1.14.0 Shell Upload
WordPress ACF City Selector plugin versions 1.14.0 and below suffer from a remote shell upload vulnerability...
WordPress WP Load Gallery 2.1.6 Shell Upload
NgocCode WP Load Gallery plugin version 2.1.6 suffers from a remote shell upload vulnerability...
XOne Web Monitor 02.10.2024.530 SQL Injection
An unauthenticated SQL injection vulnerability has been discovered in the login functionality of XOne Web Monitor version 02.10.2024.530 framework 1.0.4.9. This flaw allows attackers to exploit improper handling of user input during the authentication process to extract all stored usernames and...
F5 BIG-IP TMSH CLI Command Injection
A command injection vulnerability exists in the F5 tmsh restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and obtain remote code execution as the root user on the target syst...
Ivanti EPM Credential Coercion
This is a proof of concept exploit for Ivanti EPM vulnerabilities that allow for unauthenticated coercion of the Ivanti EPM machine credential for use in relay attacks...
Ghost CMS Arbitrary File Read
Ghost CMS versions prior to 5.59.1 proof of concept arbitrary file read exploit...
Wazuh Unsafe Deserialization / Remote Code Execution
Wazuh versions starting at 4.4.0 and before 4.9.1 suffer from an unsafe deserialization vulnerability that allows for remote code execution...
LimeSurvey 5.2.4 Shell Upload
LimeSurvey version 5.2.4 proof of concept exploit that upload a malicious PHP plugin to obtain a reverse shell...
MikroTik RouterOS Username Enumeration
MikroTik RouterOS suffers from a username enumeration vulnerability...
Zabbix SQL Injection / Privilege Escalation
This proof of concept exploit can be used on Zabbix server versions prior to 6.0.32rc1, 6.4.17rc1, and 7.0.1rc1 leverages SQL injection and achieves remote code execution through a reverse shell...
GZDoom 4.13.1 Remote Code Execution
GZDoom versions 4.13.1 and below suffer from a vulnerability involving array sizes in ZScript, the game engine's primary scripting language. It is possible to dynamically allocate an array of 1073741823 dwords, permitting access to the rest of the heap from the start of the array and causing a...
Web Security Training
This document is aimed at those who want to learn more about web security and application penetration testing. It is coupled with a free course and provides topics with a few bullet points describing what the vulnerability entails, then a screenshot and relevant payload, demonstrating the...
The DEF CON 32 Hackers' Almanack
The DEF CON 32 Hackers' Almanack is a novel first cut at bridging the chasm between policy makers and technologists. Through a new initiative, dubbed "Franklin," the Almanack will elevate the most interesting, impactful and cutting edge talks, research, and vulnerabilities identified across the D...
CISA: Eliminating Buffer Overflows
This Secure by Design Alert is part of an ongoing series aimed at advancing industry-wide best practices to eliminate entire classes of vulnerabilities during the design and development phases of the product lifecycle. This paper focuses on buffer overflows...
WordPress Bit File Manager 6.5.5 Race Condition / Remote Code Execution
WordPress Bit File Manager plugin versions 6.0 through 6.5.5 suffer from a remote code execution vulnerability via a race condition...
GNU Transport Layer Security Library 3.8.9
GnuTLS is a secure communications library implementing the SSL and TLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols, as well as APIs to parse and write X.509, PKCS 12, OpenPGP, and other...
Sensaphone WEB600 Monitoring System Cross Site Scripting
The Sensaphone WEB600 Monitoring System was found to suffer from multiple persistent cross site scripting vulnerabilities...
Botan C++ Crypto Algorithms Library 3.7.1
Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS 10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to...
Backdrop CMS 1.29.2 Cross Site Scripting / Cross Site Request Forgery
Backdrop CMS version 1.29.2 remote exploit that chains a persistent cross site scripting vulnerability with a cross site request forgery payload to achieve privilege escalation form the role of Editor to Administrator...
Linux ax88179_rx_fixup() Out-Of-Band Access
drivers/net/usb/ax88179178a.c contains multiple out-of-bounds accesses in ax88179rxfixup, the function responsible for taking a buffer received over USB and splitting it up into ethernet packets. This can be abused by a malicious USB device to leak and probably also corrupt out-of-bounds kernel...
Packet Storm New Exploits for January, 2025
This archive contains all of the 101 exploits added to Packet Storm in January, 2025...
CISA: Contec CMS8000 Contains a Backdoor
This fact sheet details an analysis of three firmware package versions of the Contec CMS8000, a patient monitor used by the U.S. Healthcare and Public Health HPH sector. Analysts discovered that an embedded backdoor function with a hard-coded IP address and functionality that enables patient data...
Interagency Security Committee Compliance Policy and Compliance Benchmarks, 2024 Edition
The Interagency Security Committee Compliance Policy and Compliance Benchmarks, 2024 Edition outlines the ISC Compliance Policy and updates Compliance Benchmarks in alignment with Executive Order 14111 and the updated Risk Management Process Standard of 2024. These updated compliance benchmarks a...
Iconv Arbitrary File Read
This script is designed to exploit a vulnerability in systems that use the iconv library with improper handling of character encoding conversions, as described in CVE-2024-2961. The vulnerability allows an attacker to read arbitrary files on the server by leveraging PHP filter chains and improper...
A Pwn2Own SpiderMonkey JIT Bug
A Pwn2Own SpiderMonkey JIT Bug: From Integer Range Inconsistency to Bound Check Elimination then RCE. This repository contains proof of concept, exploit, and analysis slide for CVE-2024-29943...
7-Zip Mark-of-the-Web Bypass
Proof of concept exploit that allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. All versions before 24.09 are considered vulnerable...
Forescout SecureConnector 11.3.07 Privilege Escalation
Forescout SecureConnector versions 11.3.07 and below privilege escalation proof of concept that makes use of an insecure permissions vulnerability...
WordPress Email Subscribers by Icegram Express 5.7.14 SQL Injection
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress and WooCommerce plugin for WordPress is vulnerable to SQL Injection via the run function of the IGESSubscribersQuery class in all versions up to, and including, 5.7.14 due to insufficient escaping on...
CISA: Closing the Software Understanding Gap
CISA document to help close the gap and secure infrastructure with a deep, scalable understanding of software-controlled systems, including AI-systems...
Ivanti Connect Secure IFT TLS Stack Overflow / Remote Code Execution
This is an Ivanti Connect Secure IFT TLS stack overflow pre-authentication remote code execution proof of concept exploit. It is crippled by default...
CISA: Microsoft Expanded Cloud Logs Implementation Playbook
This playbook provides a detailed overview of the newly introduced logging capabilities in Microsoft Purview Audit Standard. These capabilities enable organizations to conduct forensic and compliance investigations by accessing critical events...