CVE-2026-90444

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

CVE-2026-54165

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-25645

CVE-2026-25645 Reutilización insegura de archivos temporales en requests.utils.extractzippedpaths Resumen ejecutivo Se identificó una vulnerabilidad en la biblioteca requests Python dentro de la función de utilidad pública requests.utils.extractzippedpaths. La función utiliza un nombre de archivo...

CVE-2026-89606

In the Linux kernel, the following vulnerability has been resolved: ecryptfs: reject too-small tag 70 packets ecryptfsparsetag70packet subtracts fixed metadata fields from the parsed packet body size to derive the encrypted filename size. A malformed packet with a body smaller than those fixed...

PSTrojanFile

PSTrojanFile Windows PowerShell Nombre de Archivo y API Anti-Malware de Defender - POC de Ejecución de Código Descubrimiento: John Page alias hyp3rlinx 2019 y revisado 2023 Actualizado 24 de diciembre de 2023 Evadiendo el obstáculo de las comillas simples en PowerShell para ejecución de código y,...

CVE-2026-45767 Suricata datasets: save to absolute filename can be bypassed when combined with load command

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some...

CVE-2026-73693 FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler

FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...

CVE-2026-73693

FileRun before 2026.3.0 is vulnerable to OS command injection in the PhotoProofSheet handler. The root cause is a missing escapeshellarg() call when constructing the ImageMagick montage command, allowing authenticated users with upload permission to execute arbitrary commands by uploading files w...

CVE-2025-65754

CVE-2025-65754：Algernon 1.17.4 中的存储型 XSS 描述 Algernon v1.17.4 存在跨站脚本（XSS）漏洞，攻击者可通过精心构造的文件名有效载荷执行任意代码。 受影响项目：Algernon - 1.17.4 项目维护者：Alexander F. Rødseth xyproto 漏洞类型：跨站脚本（XSS） 攻击向量：攻击者可上传包含恶意名称的文件，以更改网站内容或窃取 Cookie 劫持会话。 部分变量未进行清理。 例如： engine/dirhandler.go 第 80-108 行 root@kitploit: filename :=...

CVE-2026-88288

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

EUVD-2026-75323

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

gin-vulnerable

gin-vulnerable 演示消费者固定使用 github.com/gin-gonic/gin v1.7.0（存在 CVE-2023-29401 漏洞）。/download/:filename 处理器直接将用户输入传递给 Context.FileAttachment——这是 Endor 标记为可利用的漏洞利用条件模式。...

POC_CVE-2024-10829

POCCVE-2024-36420 针对影响 Flowise 的 CVE-2024-36420 的本地复现实验室和 nuclei 模板草稿。 摘要 CVE-2024-36420 是 Flowise 中的一个任意文件读取漏洞，由对以下端点的 fileName 请求体参数的不安全使用导致： POST /api/v1/openai-assistants-file 该实验室用于验证： 易受攻击行为（flowiseai/flowise:1.4.3） 拒绝访问行为（更新的 flowiseai/flowise:3.1.2） 参考...

CVE-2026-5027

Esta publicación es un artículo de investigación publicado por EQSTLab. Gracias aYahia Hamza, quien reportó y analizó esta vulnerabilidad. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Descripción CVE-2026-5027 : Vulnerabilidad de escritura arbitraria de...

CVE-2026-25548

CVE-2026-25548 — Remote Code Execution in InvoicePlane 1.7.0 Vulnerability: Remote Code Execution via Local File Inclusion + Log Poisoning Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Critical CVSS 3.1 Score: 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CW...

cve-2026-21440-writeup-poc

cve-2026-21440 path traversal a escritura arbitraria de archivos en @adonisjs/bodyparser descripción general existe una vulnerabilidad crítica de path traversal en el paquete @adonisjs/bodyparser que permite a atacantes remotos escribir archivos arbitrarios fuera del directorio de subida previsto...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : SPICE vdagent vulnerabilities (USN-8723-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8723-1 advisory. It was discovered that SPICE vdagent had an integer overflow in the buffer size...

CVE-2025-60787-Detection-motionEye-RCE-via-Config-Injection

README.md CVE-2025-60787 检测：motionEye 配置注入导致的远程代码执行 motionEye 静态图像 - 图像文件名 PoC 载荷示例： root@kitploit: $touch /tmp/test.%Y-%m-%d-%H-%M-%S 当 motion 重启时，Shell 命令将执行并创建 /tmp/test。 检测覆盖范围 YARA 检测 扫描 motionEye 配置目录： root@kitploit: yara -r rules/yara/motioneyercecve202560787.yar /etc/motioneye/ KQL...

POC_CVE-2024-36420

POCCVE-2024-36420 针对 Flowise 的 CVE-2024-36420 本地复现实验室与 nuclei 模板草稿。 摘要 CVE-2024-36420 是 Flowise 中因未对 fileName 请求体参数进行清理而导致的任意文件读取漏洞，漏洞位于： POST /api/v1/openai-assistants-file 该实验室用于验证： flowiseai/flowise:1.4.3 版本的脆弱行为 较新版本 flowiseai/flowise:3.1.2 的拒绝行为 参考...

CVE-2026-67434

A flaw was found in PHPCodeSniffer. This command injection vulnerability allows an attacker to execute arbitrary shell commands. This occurs when PHPCodeSniffer processes untrusted files with specially crafted filenames containing shell metacharacters, specifically when generating Gitblame,...