7-Zip-CVE-2025-0411-POC

7-Zip-CVE-2025-0411-POC CVE-2025-0411 Details "This vulnerability CVSS SCORE 7.0 allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

archiver-MOTW-support-comparison

Comparison of MOTW Mark of the Web propagation support of archiver software for Windows English | Japanese Background On 3 March 2022, Microsoft announced that the default behavior of Office applications on Windows will be changed to block macros in files from the internet such as email attachmen...

7-Zip-CVE-2025-0411-POC

7-Zip Mark-of-the-Web Bypass Vulnerability CVE-2025-0411 - POC CVE-2025-0411 Details "This vulnerability CVSS SCORE 7.0 allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that...

WP Cerber < 8.9.3 - Broken Access Control

WP Cerber 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints, exploit requires sending a request with a trailing '?'. id: CVE-2021-37598 info: name: WP Cerber 8.9.3 - Broken Acces...

watermarks-remover

root@kitploit: | | | || | | |/ |/| || |/ |/ |/ | |/| | | | | | |/ ||| | | | | | \ | | | | | \ | \ | \ | | | || / | | \ watermarks-remover Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files — for privacy and hygiene on content you own. The skill is a...

CVE-2025-0411-PoC

更多PoCs at: https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X Compile with MinGW-w64 x8664-w64-mingw32-g++ loader.cpp -o loader.exe -s -static After compilation, compress the exe with 7z and execute twice. Since this vulnerability requires user interaction, the generated compressed file needs...

CVE-2026-87978

The Paymob for WooCommerce WordPress plugin, in versions prior to 4.1.14 , contains a vulnerability where it fails to verify the request signature on one branch of its payment webhook . This flaw allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without performing an a...

CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass

CVE-2025-0411-7-Zip-Mark-of-the-Web-Bypass This repository is about CVE-2025-0411 7-Zip Mark-of-the-Web Bypass vulnerability...

CVE-2025-65318-and-CVE-2025-65319

PoC for CVE-2025-65318 and CVE-2025-65319 CVE-2025-65318 BDU:2025-13740: When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of bo...

CVE-2022-30190

CVE-2022-30190 CVE-2022-30190 CVE-2022-30190 Follina POC Host exploit.html on localhost, port 80. Open the docx to pop calc. To change the remote address the doc points to, open in 7Z and edit word\rels\document.xml.rels to point to a new location. YOU MUST keep the exclamation mark. It will...

CVE-2026-93977

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-93977 code-projects Assessment Management add-single-mark.php cross site scripting

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

EUVD-2026-83720

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-93977

code-projects Assessment Management 1.0 is affected by a cross-site scripting (XSS) vulnerability in the file lecturer/add-single-mark.php . Manipulating the mark parameter allows an attacker to inject script into the application. Remote exploitation is possible, requiring low privileges and user...

CVE-2026-93977: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: xtables: avoided NFPROTOUNSPEC where needed syzbot managed to call xtcluster via ebtables: WARNING: CPU: 0 PID: 11 at net/netfilter/xtcluster.c:72 xtclustermt+0x196/0x780 .. ebtdotable+0x174b/0x2a40 The module...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Do not write dirty data after degrading to read-only. According to the syzbot report, the call to markbufferdirty from nilfssegctordoconstruct generates a warning with certain patterns after nilfs2 detects metadata...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fs: writeback: Fixed a use-after-free in markinodedirty. A use-after-free issue occurred when markinodedirty accessed bdiwriteback, which was in progress during the switch operation. CPU: 1, PID: 562, Comm: systemd-random-Not...

AZL-100446 CVE-2026-89601 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ext2: Fix lost inode updates for ISSYNC inodes ext2setsize and ext2xattrset2 had a construct like: if ISSYNCinode syncinodemetadatainode, 1; else markinodedirtyinode; which leads to lost inode updates for ISSYNC inodes because...