EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

GHSA-GXMJ-R5RF-GGWQ elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

Summary elFinder provides uploadDeny and uploadAllow options in its connector configuration to restrict which MIME types may be uploaded. When uploadDeny includes text/x-php, direct upload of .php, .phtml, and .phar files is correctly blocked. However, the extract command ZIP decompression...

NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...

GHSA-F794-5JV7-7672 NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...

CAPE-parsers

CAPE-parsers Parsers principales y de la comunidad de CAPE Estructura de configs root@kitploit: CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any othe...

veeam-velociraptor

Veeam Backup & Replication Velociraptor artifacts - PoC This repository contains a collection of Velociraptor artifacts acting as a proof-of-concept for a remote Veeam Backup & Replication forensics pipeline: artifacts/ contains the artifact definitions tools/ contains a qemu-img.zip archive that...

Radmin3-Password-Cracker

Radmin Server 3 Dumper/Cracker For more context about this tool, see https://www.synacktiv.com/publications/cracking-radmin-server-3-passwords.html ! How to use : Step 1 : Recover Radmin Server 3 user information from HKEYLOCALMACHINE\SOFTWARE\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin...

CVE-2024-13478

CVE-2024-13478 LTL Freight Quotes – TForce Edition = 3.6.4 - Unauthenticated SQL Injection Description The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.6.4 due to...

CVE-2024-50491

CVE-2024-50491 RSVP ME = 1.9.9 - Unauthenticated SQL Injection Description The RSVP ME plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2023-41652

CVE-2023-41652 RSVPMarker = 10.6.6 - Unauthenticated SQL Injection Description: The RSVPMarker plugin for WordPress is vulnerable to SQL Injection via the 'email' parameter in versions up to, and including, 10.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2019-9053-Exploit-Python-3

CVE-2019-9053 Exploit Python 3 This repository contains an exploit for the vulnerability CVE-2019-9053 found in the CMS Made Simple CMSMS software. The exploit has been modified to work with Python 3 and is compatible with CMSMS version 2.2.9 and below. Description CVE-2019-9053 is a Time-Based...

panrapidcheck

PAN Rapid Check Simpleyou should probably just do this in bash with grep PANOS support file checker that extracts some places to look for CVE-2024-3400 IoCs Generate the support file from Device - Support - Generate Tech Support file iocs.txt should include IPs/hosts from known bad for example...

CVE-2024-24919

CVE-2024-24919 Hello everyone, I am sharing a modified script from CVE-2024-24919 which can extract paths categorized as critical...

ds-cve-plugin

Welcome to ds-cve-plugin A plugin for DataSurgeon that Extracts CVE Numbers From Text e.g: CVE-2021-56789 Jump Right In To Managing Plugins Adding a new Plugin Removing a Plugin Listing All Plugins Jump Right In To Creating Find Your Plugin File Creating Your Own Plugin How to Use Your New Plugin...

rtf_exploit_extractor

rtfexploitextractor Script to extract malicious payload and decoy document from CVE-2015-1641 exploit documents root@kitploit: usage: rtfexploitextract.py -h -o OUTFILE -d DECOY -l LENGTH -v inputfile inputfile exploit document to examine optional arguments: -h, --help show this help message and...

CVE-2026-30039

CVE-2026-30039 Security advisory materials for CVE-2026-30039, a symlink-based archive extraction issue in rarfile affecting versions 4.2 and earlier. English advisory | 中文版本 Overview rarfile extracts symbolic links from attacker-controlled RAR archives without validating whether the embedded...

CVE-2024-0406-POC

CVE-2024-0406 Proof of Concept PoC This repository contains a Proof of Concept PoC exploit for CVE-2024-0406 , a vulnerability involving symlink-based tar archive extraction that allows for path traversal or file overwriting in affected systems. More Details at Path Traversal in mholt/archiver...

tp-link-decrypt

NOTE as of 5 October 2025 this project is now depreciated. Nate Robbins has kindly taken over and added switch decryption - https://github.com/robbins/tp-link-decrypt ====================================================================================================== If you found this tool...

CVE-2025-6218_WinRAR

🧪 CVE-2025-6218: Path Traversal en WinRAR 📌 Descripción Este laboratorio demuestra cómo explotar la vulnerabilidad CVE-2025-6218 en versiones vulnerables de WinRAR para Windows. Esta vulnerabilidad permite que un archivo .rar malicioso sobrescriba archivos fuera del directorio de extracción usand...