Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 143.0.7499.41, which stems from an improper implementation of the download feature and could lead to UI spoofing by a local attacker via a specially crafted HTML page...

PT-2025-48679

Name of the Vulnerable Software and Affected Versions Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2 Description An out-of-bounds read issue exists in Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2. The DownloadFile function uses the atoi function to convert a parameter to an integer, which is then...

Microsoft Security Advisory: Update Rollup for ActiveX Kill Bits

Microsoft Security Advisory: Update Rollup for ActiveX Kill Bits Microsoft has released a Microsoft security advisory about this issue for IT professionals. The security advisory contains additional security-related information. To view the security advisory, visit the following Microsoft website...

CLSA-2025-1764615456 Update of python3.11-setuptools

CVE:2025-47273: fix path traversal in PackageIndex.download leading to arbitrary file write...

CLSA-2025-1764615000 python3.11-setuptools: Fix of CVE-2024-6345

CVE-2024-6345: Fix code injection vulnerability in package download functions...

CVE-2025-59890

Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is...

Monsta FTP CVE-2025-34299

Monsta FTP - Arbitrary file download from malicious FTP server leading to RCE CVE-2025-34299 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpserver import Ftpserver import json import os import random import string import tempfile import threading impor...

FTP Download Directory

Downloads entire directory structure from FTP server recursively !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import time class ModulePost, FTPClientMixin: """FTP Download All Module""" info = "name": "FTP...

FTP Gather File Listing

Enumerates files and directories on FTP server, optionally downloading interesting files !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Enumeration Module""" info =...

Download from S3

Download files or entire buckets from S3 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os class ModulePost: """Download files or buckets from S3""" info = "name": "Download from S3", "description": "Download files or entire buckets from S3", "author":...

Wordpress-BRUTE-FORCE-UPLOAD-SHELL

🛠️ Wordpress-BRUTE-FORCE-UPLOAD-SHELL - Simple Tool for WordPr...

EUVD-2025-199904

OrangeHRM is a comprehensive human resource management HRM system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does not enforce the required authorization checks before serving candidate files. Even users restricted to ESS-level access, who have no...

CVE-2025-65963

Files is a module for managing files inside spaces and user profiles. Prior to versions 0.16.11 and 0.17.2, insufficient authorization checks allow non-member users to create new folders, up- and download files as a ZIP archive in public spaces. Private spaces are not affected. This issue has bee...

CVE-2020-36873

Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorizatio...

CVE-2020-36874

ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may...

CVE-2020-36871

ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint allows remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup can include...

EUVD-2025-199818

Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is...

EUVD-2020-30819

ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint allows remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup can include...

EUVD-2020-30822

ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may...

WordPress plugin: Google Drive upload and download link – Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...