gophish

Gophish 复刻 这是 Gophish 的一个复刻：开源钓鱼工具包 Gophish 新特性 此复刻专注于为单个客户运行真实钓鱼活动。增加了以下功能： 脚本用于在新的 VPS 上自动设置一个完整配置的 Gophish 实例。这允许你为每个客户单独使用一个 VPS。这有助于防止数据泄露，并且在完成活动后你可以完全销毁该 VPS。 支持在 HTTP 和 HTTPS 上运行你的登录页（HTTP 将 301 重定向到 HTTPS）。 支持在未提供 RID 时显示默认登录页（而不是显示 404）。 自动为你的域名安装 Let's Encrypt 证书。 支持跟踪恶意 Word...

CVE-2026-91797

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

CVE-2025-57231

CVE-2025-57231 - Docmost 0.22.0 - Lectura arbitraria de archivos Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2025-57231. Descargo de responsabilidad Este proyecto se proporciona únicamente con fines educativos y para pruebas de seguridad autorizadas. No lo utilice cont...

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent c...

EUVD-2026-84741

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

CVE-2026-84642

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain...

CVE-2024-9756

🚀 WooCommerce 任意文件上传漏洞利用 CVE-2024-9756 📌 概述 此漏洞利用利用了 WordPress 的 Order Attachments for WooCommerce 插件（版本 2.0 至 2.4.1 ）中的一个 未授权有限任意文件上传漏洞 。 该漏洞允许 经过身份验证的用户（订阅者及以上） 在未经适当授权的情况下上传受限文件类型。 ⚠️ 免责声明 此脚本仅用于教育和安全研究目的。 任何在非自有系统上未经授权使用此漏洞的行为均严格违法。 🔗 CVE 详情 CVE ID： CVE-2024-9756 受影响插件： Order Attachments for...

CVE-2025-66956

CVE-2025-66956 Asseco SEE Live 2.0 中“联系计划”、“电子邮件”、“短信”和“传真”组件存在不安全的访问控制，允许远程攻击者通过可计算的 URL 访问并执行附件。 CVSS 向量 CVSS 3.1：9.8，CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS 4.0：10.0，CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H 攻击向量 1...

CVE-2026-29780

Vulnerabilidad de Path Traversal en el Script de Ejemplo Oficial que Permite Escritura Arbitraria de Archivos Resumen El script de ejemplo oficial examples/recursivelyextractattachments.py contiene una vulnerabilidad de path traversal que permite la escritura arbitraria de archivos fuera del...

CVE-2026-87254

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-87258

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-87258

Oracle Agile PLM (Oracle Supply Chain) is affected in component Folders, Files & Attachments on supported version 9.3.6 . A low-privileged attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires human interaction from a user other than the att...

EUVD-2026-79911

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

EUVD-2026-79908

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-87254

CVE-2026-87254 affects Oracle Agile PLM (product of Oracle Supply Chain), specifically the Folders, Files & Attachments component, in supported version 9.3.6 . The vulnerability is difficult to exploit but allows a low-privileged attacker with network access via HTTP (no user interaction required...

CVE-2026-68533

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

EUVD-2026-79144

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

PT-2026-93079

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

PT-2026-93076

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...