CVE-2025-65754

CVE-2025-65754 : Algernon 1.17.4의 저장형 XSS 설명 Algernon v1.17.4는 교차 사이트 스크립팅XSS 취약점의 영향을 받으며, 공격자가 조작된 페이로드를 파일 이름에 삽입하여 임의 코드를 실행할 수 있습니다. 영향 받는 프로젝트 : Algernon - 1.17.4 프로젝트 관리자 : Alexander F. Rødseth xyproto 취약점 유형 : 교차 사이트 스크립팅XSS 공격 벡터 : 공격자는 악성 이름을 가진 파일을 업로드하여 웹사이트 콘텐츠를 변경하거나 쿠키를 도용하여 세션을...

EUVD-2026-93657

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

PT-2026-107102

The CakeResponse::download method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied filename into a quoted-string value without sanitization. Two distinct injection vectors exist in the unpatched code. First, if the filename...

CVE-2025-69212

CVE-2025-69212 설명 OpenSTAManager는 기술 지원, 전자 송장 발행 및 회계를 위한 관리 소프트웨어 솔루션입니다. =2.9.8 버전은 인증된 원격 코드 실행 취약점에 영향을 받습니다. 공격자는 특수하게 조작된 .zip 아카이브를 업로드하여 파일 이름이 셸 명령으로 해석될 수 있는 .p7m 파일을 포함시킴으로써 이 취약점을 악용할 수 있으며, 이로 인해 원격 서버에서 임의의 명령이 실행됩니다. 사용법 요구 사항 $ pip install requests 개념 증명 사용법 $ python3 exploit.py ...

Progress-MOVEit-Transfer-2020.1-Stored-XSS-CVE-2020-28647

Progress MOVEit Transfer 2020.1 저장형 XSS CVE-2020-28647 최근 웹 애플리케이션 테스트 수행 중 평가 범위에 포함된 애플리케이션 중 하나는 MOVEit Transfer 2020 웹 애플리케이션이었습니다. 평가를 수행하는 동안 저장형 교차 사이트 스크립팅Stored Cross-Site Scripting, XSS 취약점이 확인되었습니다. 이 블로그 게시물은 해당 취약점의 발견 및 익스플로잇 과정을 통해 웹 애플리케이션에 대한 관리자 접근 권한을 획득하는 방법을 다룹니다. 애플리케이션 전체에서...

Astra Linux - Vulnerability in Golang-1.23

The “go tool pack” subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output filenames. Extracting a malicious archive file using the “pack” subcommand can result in files being written to arbitrary locations within the filesystem...

CVE-2026-73693 FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

JLSEC-2026-1378

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-73254 Mongoose: Stored XSS via unescaped filenames in directory listing

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2026-74902

SiYuan (note-taking app) before v3.7.4 has a file upload validation flaw: filenames are inserted into HTML via insertAdjacentHTML without escaping. A crafted filename carrying script payloads triggers XSS that escalates to full OS command access when a victim drags, drops, or pastes the file into...

EUVD-2026-60583

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

BIT-RCLONE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to v1.75.0, rclone interpolates remote SFTP paths into PowerShell hash commands in backend/sftp/sftp.go, and quoteOrEscapeShellPath escapes only ASCII apostrophe even though...

CVE-2026-18127

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

CVE-2026-18127

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-48120 Kakoune has a Critical RCE via Autorestore Backup Filename Injection

Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, autorestore.kak script can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file. Kakoune 2026.05.21 fixes the issue. As a workaround, a...