15 matches found
CVE-2022-44268-
CVE-2022-44268- Für HTB-Übungen So verwendest du das python3 poc.py generate -o test.png -r /etc/passwd Lade die Datei test.png hoch und lade sie herunter python3 poc.py parse -i out.png...
auto-cve-2022-44268.sh
auto-cve-2022-44268 自动化利用 CVE-2022-44268 ImageMagick 任意文件读取漏洞 原始发现：https://www.metabaseq.com/imagemagick-zero-days/ PoC 仓库：https://github.com/duc-nt/CVE-2022-44268-ImageMagick-Arbitrary-File-Read-PoC 描述 ImageMagick 会将 "profile" 文本字符串解释为文件名 ，并将内容加载 为原始 profile，然后攻击者可以下载 调整大小后的图像，该图像将包含远程文件的内容。...
Automate_Exploit_CVE-2022-44268
Script de Automação para CVE-2022-44268 - Guia Rápido Créditos Exploit Original: VoidZone Security https://git.rotfl.io/v/CVE-2022-44268.git Este script Python automatiza o PoC deles para exfiltração de arquivos. Descrição Este script automatiza a exploração do CVE-2022-44268 divulgação de arquiv...
CVE-2025-56399
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...
CVE-2025-56399
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...
CVE-2025-56399
alexusmai laravel-file-manager 3.3.1 and before allows an authenticated attacker to achieve Remote Code Execution RCE through a crafted file upload. A file with a '.png extension containing PHP code can be uploaded via the file manager interface. Although the upload appears to fail client-side...
CVE-2025-56399
CVE-2025-56399 affects alexusmai/laravel-file-manager 3.3.1 and earlier. An authenticated user can upload a PNG containing PHP code; the upload may bypass client-side validation and be saved on the server. By using the rename API to switch the extension to .php, the file can be accessed via a pub...
PT-2024-29450 · Unknown +1 · Productinfoquick +1
Name of the Vulnerable Software and Affected Versions: productinfoquick version 1.0 Description: The issue allows attackers to execute arbitrary code by uploading a crafted PNG file, exploiting an arbitrary file upload vulnerability in the Ueditor component. Recommendations: For version 1.0, upda...
GHSA-W5MX-334J-6FWV Bagist Cross-site Scripting vulnerability
Bagisto is vulnerable to cross-site scripting XSS via png file upload vulnerability in product review option...
CVE-2023-37602
An arbitrary file upload vulnerability in the component /workplace!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...
CVE-2022-41418
An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...
CVE-2022-41418
An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file...
BlogEngine 路径遍历漏洞
BlogEngine is an open source ASP.NET blog system . The system supports Ajax comments, custom themes and more. BlogEngine v3.3.8.0 version of a security vulnerability , the vulnerability stems from its BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs component allows an attacker to upload...
PT-2021-3425 · Adobe · Magento
Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.2 and earlier Magento versions 2.4.1-p1 and earlier Magento versions 2.3.6-p1 and earlier Description: The issue is related to insufficient input validation, which could allow a remote attacker to access confidential...
