NPM: Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

NPM: Ghost: Stored XSS via SVG Uploads Bypassing Sanitization vulnerability discovered by ? in WordPress Npm ghost versions = 4.22.0, 6.65.0...

NPM: Ghost: Stored XSS via File Uploads on Local Storage

NPM: Ghost: Stored XSS via File Uploads on Local Storage vulnerability discovered by ? in WordPress Npm ghost versions = 6.22.1, 6.64.0...

ADTrapper

ADTrapper - Active Directory 安全分析平台 专业 Active Directory 安全分析与威胁检测平台 将 Windows 身份验证日志转化为可操作的安全洞察，配备高级威胁检测和交互式可视化 概述 ADTrapper 是一个全面的安全分析平台，专为网络安全专业人员设计，用于分析 Windows Active Directory 身份验证日志。该平台提供高级威胁检测、异常分析和交互式可视化，帮助识别和调查安全事件。 主要功能 54+ 检测规则 - 暴力破解、密码喷洒、权限提升、ADCS 攻击等 交互式可视化 - 用于网络关系的力导向图 SharpHound...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms 文件上传扩展 -----------------------------16345274557837-- 响应： HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-test.png.doc", "error":0, "size":19 当表单被提交时，最初上传的临时文件（tmp 文件）会被移动到新位置： POS...

CVE-2020-10977

GitLab v12.4.0-12.8.1 RCE 完全基于 https://github.com/dotPY-hax/gitlabRCE，但该工具对我来说无法正常工作，且其 HTML 解析部分显得繁琐，因此我用 JS 重写了它。 使用方法 按常规方式启动一个反向 Shell 监听器，然后运行此脚本： TARGETURI="https://target" TARGETEMAILDOMAIN="laboratory.htb" \ TARGETUSER="test" TARGETPASSWORD="Test pass 123" \ LOCALIP="10.10.14.142"...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

Adning Advertising <= 1.5.5 - Arbitrary File Upload

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

WordPress File Manager <= 7.2.1 - Directory Traversal

File Manager and File Manager Pro plugins for WordPress versions up to 7.2.1 and 8.3.4 contain a directory traversal caused by the 'target' parameter in mkfilefoldermanageractioncallbackshortcode, letting attackers read arbitrary files and upload files outside designated directories, exploit...

MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

CVE-2024-11680_PoC_Exploit

CVE-2024-11680 PoC漏洞利用 此仓库包含针对CVE-2024-11680的PoC（概念验证）漏洞利用代码，该漏洞影响ProjectSend r1605及更早版本。该漏洞利用因权限配置不当导致的认证缺陷。 功能特点 利用不当认证修改应用程序标题，以此确认漏洞存在。 启用不安全选项（客户端注册、自动批准和文件上传）。 注册新用户以演示权限配置不当问题。 测试完成后自动恢复原始应用程序标题。 使用方法 前提条件 1. 一个运行r1605或更早版本的ProjectSend 的有效目标。 2. curl：该脚本使用curl发送HTTP请求。...

CVE-2024-50379-POC

CVE-2024-50379-POC 此仓库包含一个Python脚本，用于利用CVE-2024-50379 漏洞，该漏洞允许攻击者向易受攻击的服务器上传JSP shell并远程执行任意命令。当目标服务器上的/uploads目录未受保护或缺失时，此利用工具尤为有用。 概述 CVE-2024-50379 是一个影响服务器文件上传处理不当的漏洞，使攻击者能够上传JSP shell。该shell随后可用于远程执行任意命令。提供的Python脚本通过将shell上传到易受攻击的服务器并允许通过命令行界面与服务器交互，自动化了这一过程。 前提条件 在运行脚本之前，请确保已安装以下内容： Python...

CVE-2024-1209

CVE-2024-1209 通过LearnDash中的作业泄露敏感信息。未经认证的访问者可以浏览和下载上传的作业。 漏洞: CVE-2024-1209 通过作业泄露敏感信息 CVSS: 5.3 中等 软件: LearnDash sfwd-lms 受影响版本: = 4.10.1 补丁版本: 4.10.2 部分, 4.10.3 完全 开发者: LearnDash 研究员: Karl Emil Nikka, Nikka Systems 公开发布: 2024-02-05 最后更新: 2024-02-05 概述...

CVE-2026-105867 Payload: Client uploads could overwrite S3 objects

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...

CVE-2026-105694 Penpot: Stored XSS via Unsanitised SVG Uploads

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose scripts, event-handler attributes, and foreignObject elements are stored without sanitization and served as image/svg+xml from the Penpot origin. A...

CVE-2026-105694

The open-source design and prototyping platform Penpot is vulnerable to Stored XSS in versions prior to 2.18.0 . Authenticated users with file-edit permission can upload SVG media containing unsanitized scripts, event-handler attributes, and foreignObject elements. Because these files are served ...

CVE-2026-105679

The Ghost Node.js content management system is vulnerable to Stored XSS in versions 6.22.1 through 6.64.0 . The root cause is that the restriction on content types for uploaded files is not applied when using the default local storage adapter , allowing files to be served with content types deriv...

CVE-2026-105679 Ghost: Stored XSS via File Uploads on Local Storage

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

EUVD-2026-92756

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

CVE-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...