CVE-2019-5624

CVE-2019-5624 A proof of concept for Metasploit's CVE-2019-5624 vulnerability Rubyzip insecure ZIP handling RCE Intro In February 2019 I found a new vulnerability in the Rubyzip library. It allows an attacker to exploit insecure ZIP handling Zip Slip resulting in remote command execution. This...

red-tldr

Red Team TL;DR English | 中文简体 What is Red Team TL;DR? red-tldr is a lightweight red team command lookup tool. It helps experienced red team operators quickly find the commands, techniques, and key points they need — like a man command built for offensive security. Starting from v0.5.0, red-tldr...

PoC-CVE-2019-10743

Zip Slip Demo This project demonstrates the Zip Slip vulnerability CVE-2019-10743 using the vulnerable version of the mholt/archiver package. What is Zip Slip? Zip Slip is vulnerability that was uncovered by the security researchers from Snyk. It was found that the vulnerability is impacting...

exploit-workshop

exploit-workshop In this step by step workshop you'll learn how to exploit various real world vulnerabilities existing in vulnerable versions of packages in a Node.js and Java application. Required software you need to install for this workshop You can do this workshop in 2 different flavours Usi...

SimpleHelp <= 5.5.7 - Arbitrary File Upload

SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file i.e. zip slip. This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. This template is a...

Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization

Summary ShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences e.g. ../../../../tmp/pwned.txt in entry names will have those entries reproduced verbatim in t...

-CVE-2023-33177-

Xibo CMS CVE-2023-33177 Vulnerability Tester Automated security testing tool for CVE-2023-33177 - Zip Slip Path Traversal vulnerability in Xibo CMS that leads to Remote Code Execution RCE. ⚠️ Disclaimer This tool is for educational and authorized testing purposes only. Only use on systems you own...

CVE-2025-67435-PoC

CVE-2025-67435 Researcher : Chowdhury Faizal Ahammed PluckCMS Zip Slip Remote Code Execution Vulnerability Report Executive Summary This report documents a critical security vulnerability discovered in PluckCMS that allows authenticated attackers to achieve remote code execution through a Zip Sli...

CVE-2019-14751_PoC

CVE-2019-14751PoC A Proof of Concept for CVE-2019-14751 Vulnerability Description NLTK Downloader before version 3.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during extraction. For...

CVE-2026-75598 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization

The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...

CVE-2026-75598 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization

The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...

CVE-2026-75598 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization

The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...

CVE-2018-19859

CVE-2018-19859 - RCE Proof of Concept This repository contains a proof of concept for Remote Code Execution RCE against OpenRefine 3.1-beta. By exploiting a directory traversal vulnerability inside of the Create Project functionality, CVE-2018-19859, a malicious user can upload a custom Java...

CVE-2020-8254

CVE-2020-8254: Zip Slip in Pulse Secure VPN Windows Client A vulnerability in the Pulse Secure Desktop Client 9.1R9 has Remote Code Execution RCE if users can be convinced to connect to a malicious server. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here...

Xibo-CMS-Zip-Slip-RCE-Exploit-CVE-2023-33177

Xibo CMS Zip Slip RCE Exploit CVE-2023-33177 This exploit demonstrates a path traversal vulnerability in Xibo CMS CVE-2023-33177 that allows remote code execution through malicious layout imports. Vulnerability Details CVE/Advisory: CVE-2023-33177 Affected Versions: Xibo CMS 1.8.0 - 2.3.16 Xibo C...

CVE-2026-38600

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive...

PT-2026-136304

Name of the Vulnerable Software and Affected Versions codeskyblue gohttpserver versions prior to 1.3.1 Description A Zip Slip issue exists in the '/upload' endpoint. This allows an attacker to write arbitrary files anywhere on the server by uploading a specially crafted Zip archive. Zip Slip is a...

CVE-2026-38600

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive...

CVE-2026-38600

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive...

CVE-2026-38600

A Zip Slip (path traversal) vulnerability exists in the /upload endpoint of codeskyblue gohttpserver versions through v1.3.0 . This flaw allows an attacker to write arbitrary files to any location on the server by uploading a specially crafted Zip archive. The vulnerability occurs because the app...