IOCScraper

IOC Scraper IOC Scraper utilises IOCPARSER service to fetch IOCs from different vendor Blogs, PDFs, and CSV files. Parsing IOCs is time-consuming process, using current script one can automatically extract and aggregate IOCs easily. Features Defanged IOCs : Supports extracting and defanging IOCs...

CVE-2025-46080

BUG作者: yggcwhat 受影响版本: Huocms 厂商: https://huocms.com/ 源码地址: https://gitee.com/digital-flag/huocms 漏洞文件: AttachmentController.php 受影响版本： HuoCMS - controller -backend - AttachmentController.php:editFileUrl 在 editFileUrl 方法中调用的 copy 函数中，$newPathUrl 的后缀未经过白名单验证，可被利用来修改文件名。后缀由传入的 suffixurl 控制，且其可控。...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

ExtensionSpoofer

ExtensionSpoofer ExtensionSpoofer is a Visual Basic .NET desktop app that demonstrates how file names and icons can be visually manipulated on Windows while the underlying executable file type remains unchanged. It uses the Unicode Right-to-Left Override character U+202E to reverse displayed...

IIS-ShortName-Scanner

IIS Short Name Scanner - 2012-2023 & Still Giving... Latest presentation: Beyond Microsoft IIS Short File Name Disclosure Latest blog post: https://soroush.me/blog/2023/07/thirteen-years-on-advancing-the-understanding-of-iis-short-file-name-sfn-disclosure/ I recommended everyone to try @bitquark'...

CVE-2016-2434

CVE-2016-2434...

CVE-2026-91771

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

PT-2026-91830

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

CVE-2024-12970

CVE-2024-12970 CVE-2024-12970 describe una vulnerabilidad de OS Command Injection Inyección de Comandos del Sistema presente en el software My Computer del sistema operativo Pardus. Esta vulnerabilidad permite a un usuario inyectar comandos del sistema a través del parámetro de nombre de archivo,...

CVE-2026-54165 Stored DOM-XSS in public shared-folder image gallery (one-click, unauthenticated victim)

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-54165

Dobase , an open-source self-hosted workspace, is affected by a one-click stored DOM-based XSS in its public shared-folder image gallery. The root cause is that a file's name attribute is fully attacker-controlled and never sanitized; it is round-tripped through an ERB-escaped data-name attribute...

CVE-2026-79692

Dell Secure Connect Gateway (SCG) 5.0 Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) contain an External Control of File Name or Path vulnerability. An unauthenticated remote attacker could exploit this flaw to gain filesystem access . The Dell-assigned CV...

CVE-2026-66302

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...

EUVD-2026-74044

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...

CVE-2026-69383

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

EUVD-2026-73721

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-73124

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

CVE-2026-69355

CVE-2026-69355 is a Remote Code Execution vulnerability in Microsoft Exchange Server caused by external control of a file name or path . An authorized attacker with low privileges can exploit this over the network without user interaction, leading to high impact on confidentiality, integrity, and...

Skype for Business Remote Code Execution Vulnerability

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...