Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

概念验证：CVE-2024-42008 和 CVE-2024-42010 此概念验证（PoC）演示了 Roundcube Webmail 中两个漏洞的利用，这些漏洞可实现 CSS 注入和跨站脚本（XSS）。攻击分两个阶段： 1. 通过恶意 XML 附件进行 XSS（CVE-2024-42008） 由于文件上载检查不足，可以发送包含 JavaScript 代码的 XML 文件作为附件，例如： alertorigin 这是一个已知问题，被追踪为 CVE-2020-13965，缓解措施是禁用“打开附件”选项。但文件仍然可以通过端点访问：...

netfence

Netfence 像Envoy xDS一样，但用于eBPF过滤器。 Netfence作为一个守护进程运行在你的VM/容器主机上，自动将eBPF过滤器程序注入cgroup和网络接口，并内置DNS服务器，解析允许的域名并填充IP允许列表。 Netfence守护进程可以单独通过本地Unix socket API驱动，或者连接到你通过gRPC实现的中央控制平面，以与后端同步允许列表/拒绝列表。 你的控制平面将网络规则（如ALLOW .pypi.org或ALLOW...

EUVD-2026-92012

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function gfilegetchild of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The...

xll_windows_reverse_shell

xllwindowsreverseshell xll Windows 反向 Shell 在你的攻击者（Kali）机器上： git clone https://github.com/n3rdh4x0r/xllwindowsreverseshell.git 1. 更新 revsh.ps1 2. 创建 Python HTTP 服务器 python3 -m http.server 9999 在你的攻击者（Windows）机器上： 1. 将 notpadXLL.c 移动到你的 Windows 攻击者机器上，并相应地更新 notpadXLL.c。 2. 打开 x64 Native Tools...

CVE-2018-11761

概述 在最近对Apache Tika的研究中，我发现其XML解析器存在一个DOS（拒绝服务）漏洞。该漏洞是由于解析器不正确地解析XML文档所致。 受影响版本 在ElasticSearch 6.3.1（使用Tika 1.18）和6.2.3（使用Tika 1.17）上测试 分析 众所周知，核心的ingest attachment插件通过使用Apache文本提取库Tika让Elasticsearch提取常见格式（如PPT、XLS和PDF）的文件附件。因此，让我们看一下ingest attachment插件的源代码。Java / subset of parsers for types we...

CVE-2024-21413

CVE-2024-21413 | PoC de Vulnerabilidad de Ejecución Remota de Código en Microsoft Outlook 🚀 Uso Asegúrate de tener los permisos y la autorización adecuados del propietario del sistema objetivo antes de usar este script. Requisitos previos Python 3.x impacket-smbserver Ejemplo de uso sudo python3...

Group-Office < 26.0.5 - Remote Code Execution

Group-Office before versions 6.8.150, 25.0.82, and 26.0.5 is vulnerable to remote code execution via OS command injection. The endpoint email/message/tnefAttachmentFromTempFile directly concatenates the user-controlled parameter tmpfile into an exec call. By injecting shell metacharacters into...

WP Attachment Export < 0.2.4 - Unrestricted File Download

The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress powered site. This includes details of even privately published posts and password protected posts with their passwords revealed ...

EspoCRM <= 9.3.3 - Server-Side Request Forgery

EspoCRM = 9.3.3 contains an authenticated server-side request forgery caused by improper internal-host validation using alternative IPv4 formats in HostCheck::isNotInternalHost, letting authenticated users access internal resources via /api/v1/Attachment/fromImageUrl endpoint. id: CVE-2026-33534...

User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Attachment Deletion

The WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check in the FrontendFormAjax::submitpost function. This makes it possible for unauthenticated attackers to delete attachment records through the plugin's AJAX handling when a public...

Zimbra Collaboration Suite - Cross-site Scripting

Cross-site scripting XSS vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite ZCS before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. id:...

Docmost 0.2.1-0.21.0 - Arbitrary File Read

Docmost v0.21.0 contains a path traversal caused by improper handling of avatar attachments, letting unauthenticated attackers disclose local files via a POST request on a public URL. id: CVE-2025-57231 info: name: Docmost 0.2.1-0.21.0 - Arbitrary File Read author: anirbala98 severity: high...

dapr

driver-attack-platform 背景：https://github.com/nccgroup/dapr/wiki 前提条件 相对较新版本的 nodejs（已在 v11.4.0 版本上测试） 如果目标是 Linux 桌面，并且使用 NVM 管理 nodejs 安装，请运行以下命令以允许以 root 身份运行 node。 https://stackoverflow.com/a/29903645 如果目标是 Android 设备，请安装 ADB。设备上必须存在 su，或者 ADB 必须以 root 身份运行。 安装 cd server npm install npm run...

CVE-2023-47504-POC

CVE-2023-47504 POC 针对 CVE-2023-47504 的利用程序。 根据 NIST 的描述，该漏洞应允许未经身份验证的用户访问 Elementor Website Builder 插件中的功能。 根据我对该漏洞的研究，以及从描述该漏洞的 Patchstack URL...

CVE-2026-104472

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

EUVD-2026-91395

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104472

YesWiki versions prior to 4.6.7 are affected by a missing authorization vulnerability in the attachment download handler . This flaw allows unauthenticated attackers to bypass page read Access Control Lists (ACLs). By requesting the download handler with a known page tag and file parameter , an a...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...