LetsDefend-SOC336-Windows-OLE-Zero-Click-RCE-Exploitation-Detected-CVE-2025-21298

LetsDefend SOC336: Обнаружена эксплуатация Windows OLE с нулевым кликом RCE В этом репозитории описано мое расследование оповещения LetsDefend, связанного с эксплуатацией уязвимости удаленного выполнения кода с нулевым кликом в Windows OLE CVE-2025-21298. Цель — показать ход рассуждений, приведши...

CVE-2026-34212

CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I identified, responsibly disclosed, and reproduced a High-severity stored XSS issue in Docmost , the...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

WP Attachment Export < 0.2.4 - Unrestricted File Download

The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress powered site. This includes details of even privately published posts and password protected posts with their passwords revealed ...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

Zimbra Collaboration Suite - Cross-site Scripting

Cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. id:...

CVE-2026-48939

CVE-2026-48939 — Эксплойт RCE iCagenda Joomla Загрузка произвольных файлов без аутентификации → Исполнение PHP-кода Обзор CVE-2026-48939 — это критическая уязвимость с рейтингом CVSS 10.0 в расширении календаря событий iCagenda для Joomla. Функция прикрепления файлов в форме регистрации на событи...

CVE-2026-34213

CVE-2026-34213 A low-privileged Docmost user could supply a victim attachmentId to the generic upload endpoint and overwrite another page's stored attachment inside the same workspace. Intro I identified, responsibly disclosed, and reproduced a High-severity authorization flaw in Docmost , the...

CVE-2025-65318-and-CVE-2025-65319

PoC для CVE-2025-65318 и CVE-2025-65319 CVE-2025-65318 BDU:2025-13740: При использовании функции взаимодействия с вложениями Canary Mail 5.1.40 и ниже сохраняет документы в файловую систему без тега Mark-of-the-Web, что позволяет злоумышленникам обходить встроенные механизмы защиты файлов как ОС...

CVE-2025-32432

CVE-2025-32432 PoC de RCE sin autenticación en Craft CMS Ejecución remota de código crítica sin autenticación en Craft CMS Afectado: Craft CMS 3.x, 4.x y 5.x hasta 5.6.16 Info: Este exploit está probado contra la máquina Orion de HackTheBox Resumen Este repositorio contiene un exploit de prueba d...

CVE-2018-11761

概述 在最近对Apache Tika的研究中，我发现其XML解析器存在一个DOS（拒绝服务）漏洞。该漏洞是由于解析器不正确地解析XML文档所致。 受影响版本 在ElasticSearch 6.3.1（使用Tika 1.18）和6.2.3（使用Tika 1.17）上测试 分析 众所周知，核心的ingest attachment插件通过使用Apache文本提取库Tika让Elasticsearch提取常见格式（如PPT、XLS和PDF）的文件附件。因此，让我们看一下ingest attachment插件的源代码。Java / subset of parsers for types we...

research-cve-2025-68971

CVE 2025-68971 | Holloway Chew, Kean Ho's Knowledge Research 22 декабря 2025 года была обнаружена уязвимость CVE 2025-68971 CVSS: 5.5/СРЕДНЯЯ в приложении с открытым исходным кодом Forgejo 13.0.3, впервые выявленная в операционной системе FreeBSD14. Это привело к массовому уничтожению всех...

Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Prova di concetto: CVE-2024-42008 e CVE-2024-42010 Questa prova di concetto PoC dimostra lo sfruttamento di due vulnerabilità in Roundcube Webmail che consentono l'iniezione CSS e il cross-site scripting XSS. L'attacco consiste in due fasi: 1. XSS tramite allegato XML malevolo CVE-2024-42008 A...

CVE-2024-21413

CVE-2024-21413 | PoC della vulnerabilità di esecuzione remota di codice in Microsoft Outlook 🚀 Utilizzo Assicurati di avere i permessi e l'autorizzazione appropriati dal proprietario del sistema di destinazione prima di utilizzare questo script. Prerequisiti Python 3.x impacket-smbserver Esempio ...

CVE-2025-25279-Mattermost-Path-Traversal

🔥 CVE-2025-25279 — Mattermost 10.4.1 📤 Path Traversal in Focalboard che permette l'esfiltrazione di file 🌟 Presentazione Questa proof of concept dimostra lo sfruttamento della vulnerabilità CVE-2025-25279 che colpisce Mattermost 10.4.1. Un difetto in Focalboard il modulo di gestione delle bachech...

CVE-2026-55696

PrivateBin versions prior to 2.0.5 contain a stored XSS vulnerability in the attachment download link. The root cause is that DOMPurify sanitization in AttachmentViewer.setAttachment only applies to image/*svg MIME types, and the resulting sanitized blob is assigned to a local variable used for t...

CVE-2026-55696 PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

CVE-2026-28289

🚨 CVE-2026-28289 — “Mail2Shell” RCE zero-click non autenticata in FreeScout tramite bypass degli allegati email 📖 Panoramica CVE-2026-28289 , soprannominata Mail2Shell , è una vulnerabilità critica di Remote Code Execution RCE zero-click che colpisce FreeScout. Un attaccante può inviare un'email...

CVE-2021-38295-PoC

CVE-2021-38295-PoC Ein einfacher Python-Proof-of-Concept für CVE-2021-38295. Zugehöriger Blogbeitrag LINK ZUM BLOG Verwendung: root@kitploit: Usage: cve-xxxx Gib dem Skript einfach einen Host, eine Datenbank, auf die deine Anmeldedaten Zugriff haben, sowie das Benutzername-Passwort-Paar. Wenn all...