zombieguard

ZombieGuard Оборонительный сканер для обнаружения обхода структурных метаданных в ZIP-архивах. ZombieGuard обнаруживает противоречия между локальными заголовками файлов ZIP, записями центрального каталога и характеристиками полезной нагрузки. Эти противоречия могут использоваться, чтобы содержимо...

Se7enSlip

🔒 Se7enSlip - Сканер уязвимостей 7-Zip Впечатляющее интерактивное веб-приложение, которое демонстрирует и помогает обнаруживать критическую уязвимость CVE-2023-52169 обход пути через симлинки в архивах 7-Zip. ⚡ Возможности 🎯 Основной функционал Загрузка и анализ ZIP - Перетащите или нажмите, чтоб...

ZipRarHunter

ZipRarHunter ZipRarHunter est un puissant outil de hacking éthique en ligne de commande conçu pour casser les mots de passe des archives ZIP et RAR à l'aide d'une wordlist. Il automatise le processus de récupération des mots de passe des archives cryptées. Fonctionnalités Cracker les fichiers ZIP...

ZipCracker

ZipCracker ZipCracker est un utilitaire de force brute de mots de passe simple mais puissant pour cracker les archives ZIP protégées par mot de passe. Il est construit avec Qt et intègre un moteur de craquage personnalisé, offrant à la fois une interface en ligne de commande et une interface...

CVE-2024-55587

CVE-2024-55587 Ce dépôt est une preuve de concept pour la vulnérabilité CVE-2024-55587 dans la bibliothèque Python libarchive. Le fichier generatezip crée un zip malveillant qui exploite l'extraction non sécurisée de fichiers dans la méthode extractall de libarchive. Le fichier vulnerablezip n'es...

Arbitrary Code Injection

Grav CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to insufficient validation of uploaded ZIP archives in the Flex Objects plugin, which allows an authenticated attacker to bypass filename validation, upload malicious PHP files to the web root, and execute arbitrary code...

CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 are vulnerable to a denial-of-service attack caused by failing to apply zlib decompression output limits when ZIP entries declare a zero uncompressed size . An attacker can craft a malicious ZIP archive containing highly compressible entries that declare zero...

PT-2026-93178

Name of the Vulnerable Software and Affected Versions adm-zip versions 0.5.14 through 0.6.0 Description The software fails to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. This allows attackers to use malicious ZIP archives containing highly compressible...

CVE-2026-18048: External Control of File Name or Path

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...

CVE-2026-17014

The WP Photo Album Plus WordPress plugin, in versions prior to 9.2.07.002 , is vulnerable to unauthorized file deletion. The root cause is a failure to perform capability or nonce checks on a public REST endpoint action, specifically the delexportzips action. This flaw allows unauthenticated user...

SUSE CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

CVE-2026-28900

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks...

PYSEC-2026-2875 pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

PYSEC-2026-2856 OpenViking contains a Path Traversal vulnerability

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or...

PT-2026-59494

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Include.parse process. An attacker can access arbitrary files outside the intended markdown directory by supplying crafted include paths when markdown files are processed using md.read. Details A Directory...

CVE-2026-14966

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

CVE-2026-14966 Symlink guard bypass in unarchive module allows planting symlinks during extraction

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

EUVD-2026-42295

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

CVE-2026-14966 Symlink guard bypass in unarchive module allows planting symlinks during extraction

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...