CVE-2026-82049

CPython 3.13 and earlier are affected by a vulnerability in the tarfile module's data and tar extraction filters . A crafted archive containing a hard link to a symbolic link can cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose...

CVE-2023-40028

CVE-2023-40028 POC para CVE-2023-40028: Lectura Arbitraria de Archivos en Ghost CMS Descripción Ghost es un sistema de gestión de contenidos de código abierto. Las versiones anteriores a la 5.59.1 están sujetas a una vulnerabilidad que permite a usuarios autenticados subir archivos que son enlace...

Linux-Privilege-Escalation-CVE-2025-27591

CVE-2025-27591 - Escalada de Privilegios mediante Enlace Simbólico Escribible en below Resumen Este es un exploit simple para CVE-2025-27591 , una vulnerabilidad de escalada de privilegios local en la herramienta de monitoreo del sistema Linux below. La vulnerabilidad afecta a versiones anteriore...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs es un servicio Git ligero y autoalojado similar a una versión privada de GitHub, diseñado para ejecutarse fácilmente en servidores de bajos recursos. La vulnerabilidad CVE-2025-8110 es un fallo de seguridad crítico que permite a un atacante eludir las restricciones de...

CVE-2026-89021 MikroTik RouterOS Path Traversal via Container OCI/tar Image Extraction

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

EUVD-2026-77757

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

CVE-2026-89021

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package's OCI/tar image extraction . The root cause is unsanitized tar member path extraction during container import via /container/add, allowing an attacker to supply a crafted image with symlinks pointing ...

running-CVE-2024-32002-locally-for-tesing

We are adapting this for local use we follow this blog post but with some key differences https://amalmurali.me/posts/git-rce How It Works 1. A malicious repository gitrce includes a submodule with a specially crafted path. 2. The submodule path uses a case variation that exploits the...

POC-CVE-2025-24104-Py

PoC: Exfiltración de Archivos en iOS vía Manipulación de Backup ADVERTENCIA MUY IMPORTANTE: ESTE SOFTWARE ES UNA PRUEBA DE CONCEPTO PoC CON FINES EDUCATIVOS Y DE INVESTIGACIÓN EN SEGURIDAD ÚNICAMENTE. NO UTILICES este script en dispositivos para los que no tengas consentimiento explícito y por...

CVE-2025-27591

CVE-2025-27591 description Basically below tool allow for universal modification on its log file which lead to privilege escalation as root. details. The log file created by below is world-writable, allowing any user to modify or replace it. An attacker can exploit this by creating a symbolic lin...

CVE-2023-40028

CVE-2023-40028 Proof of Concept This repository contains a proof of concept POC for CVE-2023-40028, demonstrating a vulnerability in the Ghost content management system where authenticated users can upload symlinks, leading to arbitrary file read vulnerabilities. Disclaimer This POC is provided f...

CVE-2025-11001---7-Zip

CVE-2025-11001 - 7-Zip High-severity symlink traversal in 7-Zip allowing arbitrary file write / RCE Patched in 7-Zip 25.00 July 2025 – Public exploit available FOR AUTHORIZED SECURITY TESTING AND RESEARCH ONLY -critical Vulnerability Summary CVE : CVE-2025-11001 CVSS v3.1 : 7.0 High –...

RegPwnBOF

RegPwn BOF Adaptación BOF de Cobalt Strike del exploit RegPwn por Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. Esta es una reimplementación BOF descuidada del exploit original en C. Todo el crédito por la investigación de la vulnerabilidad y el exploit pertenece a Filip Dragovic y MDSec...

CVE-2025-55188

CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...

cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC Un POC para CVE-2024-32002 que demuestra Ejecución Remota de Código RCE. Vea cve-2024-32002-poc-rce para el repositorio de submódulos relacionado. Lo que contiene este repositorio Un enlace simbólico con un nombre arbitrario que enlaza al directorio .git. Un archivo...

CVE-2025-27591-below-

CVE-2025-27591 – Escalada de privilegios en Below 1 Introducción Below es una herramienta de Linux para registrar y mostrar datos del sistema como uso de hardware y métricas de cgroups. En versiones anteriores a v0.9.0 , el servicio systemd de Below se ejecuta con privilegios de root y crea...

CVE-2025-24104

Análisis de CVE-2025-24104: Lectura de archivos fuera del sandbox Reporté un bug que Apple luego rastreó como CVE-2025-24104. En mi informe original, demostré cómo una copia de seguridad maliciosa podía usarse para eludir las restricciones del sandbox. Sin embargo, la descripción inicial de Apple...

NimbusPWN-CVE-2022-29799-29800

NimbusPwn — networkd-dispatcher !NOTE Otra...

CVE-2026-82429

Description The setuid-root worker-launcher binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling lchown and chmod on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call,...

CVE-2026-82427

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...