CVE-2025-30208-ViteVulnScanner

CVE-2025-30208-ViteVulnScanner 哟，这是 keklick1337 写的超牛逼多线程 Python 脚本，用来扫描 Vite 中受 CVE-2025-30208 影响的域名。基本上，它会检查你是否能通过 @fs 端点配合 ?raw?? 或 ?import&raw?? 获取任意文件——比如泄露 /etc/passwd 这类敏感数据。它内置了一些智能误报过滤，免得你在垃圾信息上浪费时间，还有选项可以调整输出的格式。 它有什么能耐？ 多线程 ：扫描域名列表的速度快得飞起。 协议选择 ：选 HTTP、HTTPS，或者两种都跑。 误报清除 ：...

ViteVulScan

ViteVulScan Introducción a las vulnerabilidades Este proyecto cubre 3 vulnerabilidades: CVE-2025-30208 / CVE-2025-31125 / CVE-2025-31486, todas relacionadas con la lectura arbitraria de archivos en el servidor de desarrollo de Vite. Estas tres vulnerabilidades tienen una amplia cobertura y son...

ADFSDump

ADFSDump 一个用于从 AD FS 中导出各种好东西的 C 工具。 由 Doug Bienstock @doughsec 在 Mandiant FireEye 期间创建。 该工具设计为与 ADFSpoof 配合使用。ADFSdump 将输出使用 ADFSpoof 生成安全令牌所需的全部信息。 详细描述 ADFSDump 是一个从 Active Directory 和 AD FS 配置数据库中读取生成伪造安全令牌所需信息的工具。这些信息随后可以输入到 ADFSpoof 中以生成相应令牌。 要求 ADFSDump 必须在 AD FS 服务帐户的用户上下文下运行。您可以通过在 AD FS...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. 漏洞概述 CVE-2025-30208, CVE-2025-31125和CVE-2025-31486是Vite 开发服务器中的一个任意文件读取漏洞。该漏洞允许攻击者通过特定的 URL 参数绕过访问控制，通过fs模块读取服务器上的敏感文件。上述三个漏洞可以算作是一个系列的漏洞，因为造成漏洞的原因非常相似。 CVE-2025-30208影响版本如下所示 =6.2.0, =6.1.0, =6.0.0, =5.0.0, =6.2.0, =6.1.0, =6.0.0, =5.0.0,...

EUVD-2026-81607

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

CVE-2024-42471-PoC

CVE-2024-42471-PoC tar-fs 文件写入/覆盖漏洞...

AlmaLinux 9.2 [TuxCare] Security Update: bpftool / kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787935638)

"The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787935638 advisory. - In the Linux kernel, the following vulnerability has been resolved: fs/mountsetattr: always cleanup mountkattr Make sure that...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_19105)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202519105 advisory. kernel: vsock/virtio: Validate length in packet header before skbput CVE-2025-39718 kernel: NFS: Fix filehandle bounds checking in nfsfhtodentry...

ROS-20260930-73-0121

The vulnerability in the fs/smb/server/transporttcp.c component of the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260930-73-0135

The vulnerability of the cowfilerangeInline function in the fs/btrfs/inode.c module of the Linux kernel is related to the lack of resource release after the expiration of the license period. Exploiting this vulnerability could allow a perpetrator to cause a service failure...

ROS-20260930-73-0128

The vulnerability of the romfsfillsuper function in the fs/romfs/super.c module of the Linux kernel operating system is related to the lack of checking of the return value. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vitejs-exploit

Vite 利用工具 CVE-2025-31125 描述：利用Vite开发服务器@fs端点的路径遍历漏洞CVE-2025-31125，通过精心构造的URL访问敏感文件，如/etc/passwd和/etc/hosts。 由Muhammad Waseem创建。 用法： python viteexploit.py -u http://target.com python viteexploit.py -f urls.txt -o output.txt 依赖： Python 3.x pip install requests colorama 免责声明：...

CVE-2026-8023

CVE-2026-8023 — Zephyr HTTP static-fs 路径遍历（PoC） Zephyr HTTP 服务器 static-fs 处理器（subsys/net/lib/http）中的未认证路径遍历漏洞，当通配符资源匹配（CONFIGHTTPSERVERRESOURCEWILDCARD=y）与 HTTPRESOURCETYPESTATICFS 一起使用时触发。同时影响 HTTP/1.1 和 HTTP/2。 GHSA: GHSA-hch3-53g6-jj3h 受影响版本：= 4.0.0, = 4.4.0, 4.4.2...

ROS-20260929-73-0194

The vulnerability of the parseapplysbmountoptions function in the fs/ext4/super.c module of the Ext4 file system in the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could all...

ROS-20260929-73-0097

The vulnerability of the smb2getksmbdtcon function in the fs/smb/server/smb2pdu.c module of the Smb file system in the Linux operating system is related to the reallocation of previously released memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality...

ROS-20260929-73-0114

The vulnerability of the pnfsmarklayoutstateidinvalid function in the fs/nfs/pnfs.c module relates to errors during link counters updates in Linux kernel-based NFS client support. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of...

ROS-20260929-73-0040

The vulnerability of the cifsconstructtcon function in the fs/smb/client/connect.c module, which is part of the SMB client support in Linux kernel, involves the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to cause service...

ROS-20260929-73-0076

The vulnerability of the getfileallinfo function in the fs/smb/server/smb2pdu.c module of the Smb file system in the Linux operating system is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the...