gophish

Gophish 复刻 这是 Gophish 的一个复刻：开源钓鱼工具包 Gophish 新特性 此复刻专注于为单个客户运行真实钓鱼活动。增加了以下功能： 脚本用于在新的 VPS 上自动设置一个完整配置的 Gophish 实例。这允许你为每个客户单独使用一个 VPS。这有助于防止数据泄露，并且在完成活动后你可以完全销毁该 VPS。 支持在 HTTP 和 HTTPS 上运行你的登录页（HTTP 将 301 重定向到 HTTPS）。 支持在未提供 RID 时显示默认登录页（而不是显示 404）。 自动为你的域名安装 Let's Encrypt 证书。 支持跟踪恶意 Word...

CVE-2024-9756

🚀 Exploit de Subida Arbitraria de Archivos en WooCommerce CVE-2024-9756 📌 Resumen Este exploit aprovecha una vulnerabilidad de subida arbitraria de archivos no autorizada y limitada en el plugin Order Attachments for WooCommerce versiones 2.0 a 2.4.1 para WordPress. La vulnerabilidad permite a...

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

CVE-2026-104472

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104452

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

EUVD-2026-91395

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

EUVD-2026-91463

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104452

Versions of YesWiki prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the filemanager page handler . The root cause is the failure to validate a CSRF token on GET requests that perform file operations. An attacker could trick a logged-in administrator or p...

CVE-2026-29780

Vulnerabilidad de Path Traversal en el Script de Ejemplo Oficial que Permite Escritura Arbitraria de Archivos Resumen El script de ejemplo oficial examples/recursivelyextractattachments.py contiene una vulnerabilidad de path traversal que permite la escritura arbitraria de archivos fuera del...

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

SummaryA critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent ca...

EUVD-2026-90272

pypdf: Possible long runtimes with large amount of embedded files...

CVE-2025-66956

CVE-2025-66956 Asseco SEE Live 2.0 中“联系计划”、“电子邮件”、“短信”和“传真”组件存在不安全的访问控制，允许远程攻击者通过可计算的 URL 访问并执行附件。 CVSS 向量 CVSS 3.1：9.8，CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS 4.0：10.0，CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H 攻击向量 1...

EUVD-2026-90583

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments...

CVE-2026-103492

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a Denial of Service (DoS) attack. The root cause is the processing of crafted PSD attachments , which can lead to high availability impact. Remediation is available in version 2026.2.19422 or later. No specific exploit details or...

CVE-2026-103492

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments...

CVE-2026-103492

In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments...

EUVD-2026-90501

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

Linux Distros Unpatched Vulnerability : CVE-2026-102999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachment...

DEBIAN-CVE-2026-102999

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/doccommon.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when a...