CVE-2018-2628

脆弱性テスト シェルのアップロード 方法一： 方法二： シェルの実行 Meterpreterの取得 root@kitploit: msf use exploit/multi/script/webdelivery msf exploitmulti/script/webdelivery set target 3 target = 3 msf exploitmulti/script/webdelivery set payload windows/meterpreter/reversetcp payload = windows/meterpreter/reversetcp msf...

cve-2019-3398

cve-2019-3398 详情 一个用Python编写的针对CVE-2019-3398 Confluence漏洞的快速概念验证脚本。 受影响的Confluence版本为6.12.3、6.13.3、6.14.2和6.15.1。 该漏洞利用需要有效的凭据。 使用 编辑osusername和ospassword字段，并且根据目标服务器的情况可能需要修改filename路径。如果路径设置正确，shell.jsp将可以在Web服务器的根目录访问到。...

EUVD-2026-77449

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

CVE-2026-90931

LaraDashboard versions 0.9.0 through 1.2.2 are affected by a stored XSS vulnerability caused by failure to sanitize SVG file content during media upload. An authenticated user with only the media.create permission can upload a malicious SVG file containing embedded script tags. When any user—incl...

CVE-2026-90931 LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

CVE-2026-90931 LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated users with only the media.create permission to upload malicious SVG files containing script tags. When any user including administrators opens the stored SVG file served inline...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

EUVD-2026-77447

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-90929

File Browser versions 2.5.0 through 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS handler, the direct-upload path does not reject a target that is an existing directory. A POST with ?override=true aimed at a...

CVE-2025-31324

CVE-2025-31324 CVE-2025-31324, SAP 漏洞利用 root@kitploit: POST /developmentserver/metadatauploader?CONTENTTYPE=MODEL&CLIENT=1 HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: python-requests/2.32.3 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: keep-alive Content-Length: 636 Content-Type:...

CVE-2026-5718-Lab

CVE-2026-5718 本地 Docker 实验室 仅限本地的易受攻击版与已修补版 Docker 实验室，针对影响 WordPress 插件 Drag and Drop Multiple File Upload for Contact Form 7 的 CVE-2026-5718 。 本实验室通过仅在 Docker 环境中运行的最小危害 PHP 执行验证，演示易受攻击版本 1.3.9.6 与已修补版本 1.3.9.7 之间的差异。 适用范围：仅限 localhost / Docker 网络。请勿针对您不拥有或未经明确许可测试的系统使用此 PoC。 执行摘要 CVE-2026-5718...

ACEDcup

ACEDcup ACEDcup 工具是一个用于 Java 二进制反序列化攻击 ACED 的载荷生成器。 适用于 Apache Commons FileUpload 版本 = 1.3 CVE-2013-2186 和 Oracle JDK 版本 7u40 该攻击甚至对更新版本的库或 Java 也有效。我们可以将任意内容上传到任意目录，但 在此情况下无法控制文件名（例如 uploadf71d354772ed4ae190fe0d319115cd4200000000.tmp）。不过，在某些情况下它可能仍然有用。 此外，如果目标运行 Windows 操作系统，我们还可以执行 NTLM...

CVE-2021-32099

CVE-2021-32099 PoC 本仓库提供了针对 CVE-2021-32099 漏洞的概念验证（PoC）漏洞利用代码，该漏洞影响 Pandora FMS 742 。该漏洞利用演示了未经身份验证的攻击者如何利用 SQL 注入漏洞将会话从非特权级别提升到管理员级别。获得管理权限后，攻击者可通过 Pandora FMS File Manager 上传任意 PHP 文件，从而实现远程代码执行，并以 Web 服务器用户身份入侵服务器。 ⚠️ 免责声明 本项目仅用于教育、研究和经授权的安全测试目的 。 请勿在你不拥有或未经明确许可的系统上使用此代码。 作者不对 任何损坏或误用负责 。 安装...

gitread

gitread CVE-2026-85706 的概念验证，这是一个影响自管理 GitLab CE/EE 的未认证任意文件读取漏洞。 | ---|--- CVE| CVE-2026-85706 CVSS| 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N 受影响版本| 18.7 至 19.1.7、19.2.0 至 19.2.5、19.3.0 至 19.3.1 修复版本| 19.1.8 / 19.2.6 / 19.3.2（发布于 2026-09-10） 组件| Repository Commits API / Files API（Workhorse...

Astra Linux – Vulnerability in Python-Django

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64, including excessive whitespace. Earlier, unsupported Django versions such a...

POC-CVE-2026-19681

CVE-2026-19681 —— 文件上传处理中的命令注入（需认证） 状态：已确认 ，基于 6.7.2-14.el9 实验室环境（2026-08-20）。通过 POST /rest/file/upload 暂存的文件名为 p;sleep$IFS20;-EvvfJk（context 前缀携带元字符），随后 POST /rest/auditFile（type=scapLinux、version=1.2）恰好停滞 20.1 秒并返回错误 106（"Error adding Tailoring file to SCAP zip file"）——这是注入后正常的错误路径。执行发生在 zip -9...

CVE-2026-81565

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

CVE-2026-15814

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to limit the amount of memory allocated when decoding uploaded image files which allows an authenticated user to cause excessive server memory consumption and potential denial of service via uploading a...

CVE-2026-81565

SP Page Builder (Free and Pro) by joomshaper.com, a Joomla extension, is affected in versions 4.0.0 through 6.9.0 by a Missing Directory Confinement flaw in its media upload functionality. The folder request parameter fully replaced the generated date-based destination folder and was passed to Fo...

CVE-2026-81565 Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...