VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc Questo progetto dimostra come un driver legittimo e firmato possa essere armato per eludere le difese e distribuire un ransomware simulando un vero attacco informatico. 🚨 Testato su Windows 11 Pro 24H...

CVE-2026-9789

ID CVE: CVE-2026-9789 Ricercatore: Vo Duc Thang ugvxb Riconoscimento: https://community.acer.com/en/kb/articles/19670 Video POC: https://drive.google.com/file/d/1B8b42bE68CWMnlqG6eJWi0txGFsHAJZc/view?usp=sharing 1. Sommario esecutivo È stata scoperta una vulnerabilità critica di escalation dei...

CodePath_Week_7-8

CodePath Settimana 7-8 CodePath Assegnazione per le Settimane 7 e 8: CVE-2017-14718, CVE-2019-9787 e Modifica non autenticata del contenuto di Pagine/Post tramite API REST Progetto 7 - WordPress Pentesting Tempo impiegato: 16 ore in totale Obiettivo: Trovare, analizzare, ricreare e documentare...

CVE-2022-30206

CVE-2022-30206 Este é o PoC para CVE-2022-30206. Vulnerabilidade de Elevação de Privilégio do Windows Print Spooler. Introdução Execute as seguintes operações para exclusão arbitrária de arquivos： 1. Execute o addprinter.exe para criar uma impressora e definir o SpoolDirectory em...

CVE-2022-30206

CVE-2022-30206 Questa è la PoC per CVE-2022-30206. Introduzione Eseguire le seguenti operazioni per l'eliminazione arbitraria di file: 1. Eseguire addprinter.exe per creare una stampante e impostare la SpoolDirectory in C:\Users\Public\tmp\1. 2. Eseguire FileLock.exe TargetFile per reindirizzare ...

WordPress Shared Files Pro plugin < 1.7.68 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files Pro versions 1.7.68...

WordPress Shared Files plugin < 1.7.67 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Huynh Kien Minh in WordPress Plugin Shared Files versions 1.7.67...

PoC-for-CVE-2020-28948-CVE-2020-28949

PoC für CVE-2020-28948 & CVE-2020-28949 Die hier enthaltenen Dateien enthalten PoCs für CVE-2020-28948 & CVE-2020-28949, um einen Remote-Exploit zu ermöglichen. Der Server Der Server-Ordner enthält einen einfachen Upload-Server, der die anfällige Bibliothek ArchiveTar verwendet und sich in...

CVE-2020-0753-and-CVE-2020-0754

Writeup e POC per CVE-2020-0753, CVE-2020-0754 e sei vulnerabilità DOS di Windows non corrette Exploit del bug di race condition nel FileSystem - analisi di CVE-2020-0753 e CVE-2020-0754 Il servizio Windows Error Reporting ha corretto 2 bug di Elevation of Privilege nell'ultimo Patch Tuesday; ai...

CVE-2024-5932

Dieser Beitrag ist ein Forschungsartikel, veröffentlicht von EQSTLab. ❗❗ WICHTIG ❗❗ Es gibt derzeit gefälschte PoC-GitHub-Repositories, die xmrig ausführen. Weitere Informationen finden Sie unter den folgenden Links : URL1: https://x.com/win3zz/status/1828704644987511107 URL2:...

CVE-2020-26259

CVE-2020-26259 CVE-2020-26259: XStream1.4.14 è vulnerabile alla cancellazione arbitraria di file sull'host locale durante l'unmarshalling, purché il processo in esecuzione abbia i diritti sufficienti. https://x-stream.github.io/CVE-2020-26259.html XStream 1.4.14 pom.xml root@kitploit:...

WSO2-2021-1260

WSO2-2021-1260: WSO2 ESB में आर्टिफैक्ट नाम में पाथ ट्रैवर्सल के माध्यम से मनमानी फाइलों का विलोपन आर्टिफैक्ट अपलोड सुविधा में अनसैनिटाइज़्ड उपयोगकर्ता इनपुट के कारण, "artifactName" पैरामीटर में पाथ ट्रैवर्सल का लाभ उठाकर एक मनमानी फ़ाइल विलोपन हमला किया जा सकता है। विक्रेता प्रकटीकरण: इस भेद्यता...

CVE-2026-12513

CVE-2026-12513 affects the Shared Files WordPress plugin (before 1.7.67) and Shared Files Pro (before 1.7.68). The plugins fail to properly sanitize a file path taken from a frontend file submission, and their single-pass traversal filter is bypassable. An unauthenticated user can store a path po...

EUVD-2026-67565

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

Nevma Adaptive Images - Arbitrary File Deletion

Nevma Adaptive Images plugin before 0.6.67 for WordPress contains an arbitrary file deletion caused by unsanitized input in adaptive-images-script.php, letting remote attackers delete arbitrary files, exploit requires sending specific request parameters. id: CVE-2019-14206 info: name: Nevma...

WordPress WP Fastest Cache <= 0.9.0.2 - Authenticated Arbitrary File Deletion

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete...

Meta Box <= 4.16.2 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion in the ajaxdeletefile function. The function accepts any attachmentid from the POST request and directly calls wpdeleteattachment or unlink without validating that the attachment belongs to the specified Meta Box field,...

Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion

The Avada Fusion Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybedeletefiles function. An unauthenticated attacker can delete arbitrary files on the server by manipulating the filepath parameter in the...

CVE-2024-27460

CVE-2024-27460 - Plantronics Desktop Hub LPE Eliminazione arbitraria di file fino a SYSTEM. La maggior parte del codice si basa sul PoC di riferimento di @filipdragovic. Grazie a @filipdragovic e @k0zmer : Articolo del blog: https://mantodeasecurity.de/en/2024/05/cve-2024-27460-plantronics-hub-lp...

CVE-2026-54083

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...