Breeze <= 2.4.4 - Arbitrary File Upload

Breeze Cache WordPress plugin = 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetchgravatarfromremote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled. id:...

CVE-2017-14980

CVE-2017-14980 Sync Breeze Enterprise 10.0.28 - 缓冲区溢出研究 目标 在受控的实验室环境中，研究经典的基于栈的缓冲区溢出漏洞，用于教育目的。 本项目旨在更好地理解： 应用程序模糊测试 崩溃分析 EIP 控制 坏字符识别 内存破坏 Shellcode 执行流程 基础漏洞利用开发方法 环境 Windows 10 虚拟机 Sync Breeze Enterprise 10.0.28 Immunity Debugger Mona.py Python 实验室设置 第一步是在一台配置用于漏洞研究和漏洞利用开发的 Windows 10 虚拟机中安装 Sy...

CVE-2017-14980_syncbreeze_10.0.28_bof

漏洞利用 - CVE-2017-14980 - Sync Breeze Enterprise v10.0.28 本仓库包含一个针对 Sync Breeze Enterprise 10.0.28 版本的缓冲区溢出利用（BOF）概念验证，针对漏洞 CVE-2017-14980 。 描述 该漏洞源于在处理向 /login 端点发送的 POST 请求中的 password 字段时存在不当输入验证。 攻击者可在此字段中发送超长值，从而覆盖 EIP 并允许任意代码执行。 此漏洞利用发送精心构造的有效负载，包含： 520 字节填充（'A'） 4 字节覆盖 EIP 20 字节 NOP sled...

CVE-2026-3844-Lab

CVE-2026-3844 — Breeze Cache Unauthenticated Arbitrary File Upload to RCE Lab Local-only Docker lab for reproducing and comparing CVE-2026-3844 behavior in the WordPress Breeze Cache plugin. This repository demonstrates the vulnerable behavior in Breeze Cache 2.4.4 and compares it with the patche...

CVE-2026-3844

CVE-2026-3844 Exploit PoC para CVE-2026-3844, una vulnerabilidad crítica de subida arbitraria de archivos sin autenticación en el plugin Breeze de WordPress que conduce a RCE...

CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution

CVE-2026-3844 – Breeze Cache WordPress 插件未认证远程代码执行 -red?style=flat-square CVE-2026-3844 是 Breeze Cache WordPress 插件（版本 ≤ 2.4.4）中的一个严重的未认证任意文件上传漏洞。攻击者可以发布一条包含恶意 标签（指向 PHP Web Shell）的评论。该插件会获取并将该文件存储到公开可访问的缓存目录（/wp-content/cache/breeze-extra/gravatars/）中，从而导致远程代码执行（RCE） 。 本仓库提供了一个功能完整的 Docker 实验环境...

CVE-2017-14980

CVE-2017-14980 漏洞利用程序 用于 CVE-2017-14980 的 PoC 漏洞利用程序——Sync Breeze Enterprise 10.0.28 中的一个 基于堆栈的缓冲区溢出 漏洞。 📖 完整的漏洞利用技术分析： 👉 https://davigsantana.github.io/posts/buffer-overflow/ 关于 此仓库包含一个 概念验证 PoC ，为教育和研究目的而开发，演示了利用 Sync Breeze Enterprise 认证 Web 界面中的输入验证漏洞进行攻击。 该漏洞允许 未经身份验证的 远程攻击者导致内存损坏并获得 远程代码执行...

CVE-2026-3844

root@kitploit: ╔════════════════════════════════════════════════════════════╗ ║ CVE-2026-3844 ║ ║ Breeze Cache = 2.4.4 Arbitrary File Upload ║ ║ Unauthenticated RCE | Authorized Lab Use Only ║ ╚════════════════════════════════════════════════════════════╝ Descripción general CVE-2026-3844 es una...

Sync_Breeze_Enterprise_10_6_24_-DOS

SyncBreezeEnterprise10624-DOS root@kitploit: Exploit Title: Sync Breeze Enterprise 10.6.24 - Denial Of Service Vulnerability Date: 03-09-2018 Exploit Author: Ege Balcı Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.6.24.exe Version...

CVE-2026-3844

CVE-2026-3844 — WordPress Breeze Cache Subida de Archivos No Autenticada Resumen Este repositorio contiene un script de prueba de concepto PoC en Python para demostrar una vulnerabilidad de Subida Arbitraria de Archivos No Autenticada que afecta al plugin WordPress Breeze Cache ⚠️ Este proyecto...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache 远程代码执行 未认证任意文件上传 → 远程代码执行 字段| 值 ---|--- CVE| CVE-2026-3844 CVSS| 9.8（严重） 插件| Breeze Cache Cloudways 受影响版本| ≤ 2.4.4 修复版本| 2.4.5 发现者| Hung Nguyen bashu PoC 作者| halilkirazkaya 概述 Breeze Cache WordPress 插件（≤...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache = 2.4.4 Subida Arbitraria de Archivos No Autenticada a RCE Resumen...

CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Subida Arbitraria de Archivos sin Autenticación ⚠️ Aviso Legal root@kitploit: ESTA HERRAMIENTA SE PROPORCIONA SOLO CON FINES EDUCATIVOS Y DE INVESTIGACIÓN EN SEGURIDAD. El acceso no autorizado a sistemas informáticos es ilegal. Utilice esta herramienta...

CVE-2017-14980

🐞 CVE-2017-14980: Sync Breeze Enterprise 10.0.28 - Stack-Based Buffer Overflow Stack-based buffer overflow in Sync Breeze Enterprise 10.0.28 reachable through the /login handler, demonstrating how unchecked input length can corrupt stack memory. 📑 Table of Contents Why this repository exists Why...

CVE-2018-6537.RCE

CVE-2018-6537 The exploit targets Sync Breeze running on Windows 10 x86, build: 16299 , affecting version 10.4.18 , where an unauthenticated attacker can perform a SEH overflow via a TCP-connection, resulting in remote code execution. This exploit assumes all security mitigations are disabled e.g...

CVE-2017-14980.RCE

CVE-2017-14980 The exploit targets Sync Breeze Enterprise running on Windows 10 x86, build: 16299 , affecting version 10.0.28 , where an unauthenticated attacker can perform a buffer overflow via an HTTP-request body , resulting in arbitrary code execution. This exploit assumes all security...

CVE-2026-3844

CVE-2026-3844 批量利用工具 CVE-2026-3844 – Breeze Cache WordPress =2.4.4 在启用本地 Gravatar 托管时，允许通过 fetchgravatarfromremote 进行未认证文件上传。 安装 下载仓库 root@kitploit: git clone https://github.com/im-hanzou/CVE-2026-3844 进入仓库文件夹 root@kitploit: cd CVE-2026-3844 安装依赖 root@kitploit: pip install -r requirements.txt 使用方...

Exploit_Sync_Breeze_v10.0.28_CVE-2017-14980

ExploitSyncBreezev10.0.28CVE-2017-14980...

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet formerly UNC5669 since 2024. Google Threat Intelligence Group GTIG and Mandiant teams described the threat actor as "specializing in manipulating...

CVE-2026-79706

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory...