Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 References respect to the masters: CVE-2023-50386 vulnerability author's blog Java Security Manager Bypass Techniques Bypassing Reflection Protection in JDK 17 JNI Bypassing RASP Vulnerability exploitation...

CVE-2024-44258

CVE-2024-44258: Symlink Vulnerability in ManagedConfiguration Framework Summary CVE-2024-44258 highlights a symlink vulnerability within the ManagedConfiguration framework and the profiled daemon in Apple devices. When restoring a crafted backup, the migration process fails to validate whether th...

reload.sh

reload.sh Ne le faites pas... Veuillez ne pas le faire sur des systèmes en production par exemple en production ou sur votre ordinateur personnel où vous stockez des données critiques. Cette recette vous montre comment installer un système frais là où un autre système existe et fonctionne. C'est...

CVE-2026-1357

CVE-2026-1357 CVE-2026-1357 실습 환경 1. 환경 구축 sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone 저장소 링크 wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip wpvivid-backuprestore.0.9.123.zip sudo docker-compose up -d...

halo-2.25.4-backup-write-CVE-2026-67920

Halo CMS Backup Restore Arbitrary File Write Vulnerability Summary A critical arbitrary file write vulnerability exists in the backup restoration functionality of Halo CMS versions up to 2.25.4. The restoreWorkdir method in MigrationServiceImpl.java copies the workdir/ directory from a...

CVE-2023-33781

CVE-2023-33781 Description D-Link DIR-842V2 v1.0.3 was discovered to allow a user to run an arbitrary binary when connecting to telnet. This vulnerability can be triggered using backup/restore functionality. Proof of concept...

CVE-2022-30075

CVE-2022-30075 Tp-Link 라우터에서의 인증된 원격 코드 실행 영향을 받는 장치 Tp-Link 라우터에 백업 및 복원 기능이 있고 펌웨어가 2022년 6월보다 오래된 경우 취약할 가능성이 있습니다. 테스트 환경 Tp-Link Archer AX50, 다른 Tp-Link 라우터는 다른 형식의 백업을 사용할 수 있으며 익스플로잇을 수정해야 할 수 있습니다. PoC 라우터에서 텔넷 데몬을 시작하기 위한 익스플로잇 사용 수동 익스플로잇 1. 라우터 웹 인터페이스에 로그인합니다. 2. 고급 - 시스템 - 백업 설정으로...

Emlog 2.1.9 - SQL Injection

emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files. id: CVE-2023-39121 info: name: Emlog 2.1.9 - SQL Injection author: wjch611 severity: high description: |...

SparstanBoogie

SparstanBoogie's origins were tested reportedly on iOS/iPadOS 15.2 - 16.7 RC 20H18 and 17.0 however, tests have been conducted up to 26.1 26.1. Also any testing on devices above or under whats been reported is welcomed as it may come back in newer devices so theres no reason to shrug off any good...

EUVD-2026-69132

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified...

CVE-2026-55168

CVE-2026-55168 Этот репозиторий содержит простой PoC для CVE-2026-55168 в Runtipi. Проблема представляет собой аутентифицированную произвольную запись файла, которую можно достичь через процесс восстановления из резервной копии. Специально сформированный архив резервной копии может внедрить симли...

CVE-2025-43537

CVE-2025-43537 Crédit de sécurité Apple Chercheur : Al Sadman Awal Officiellement crédité par Apple Product Security pour la divulgation responsable de CVE-2025-43537. Aperçu CVE-2025-43537 est une vulnérabilité de sécurité identifiée lors de recherches indépendantes et divulguée de manière...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...

CVE-2023-5808

CVE-2023-5808 CVE-2023-5808 is an Insecure Direct Object Reference IDOR in vulnerability found in Hitachi NAS' HNAS' System Management Unit SMU Backup & Restore functionality. This vulnerability affects SMU versions prior to 14.8.7825.01. Exploitation This exploit requires the attacker to have...

CVE-2026-19722

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

CVE-2026-19722

WPvivid — Backup, Migration & Staging is a WordPress plugin affected by a Zip Slip vulnerability prior to version 0.9.133 . During backup restoration, the plugin does not validate the destination path of files extracted from a backup package, allowing an authenticated user with high privileges (e...

CVE-2023-22518

CVE-2023-22518 Exploit per Confluence CVE-2023-22518 RCE tramite backup-restore Endpoint POST /setup/setup-restore.action Richiede un login valido e diritti di amministratore o un bypass dell'autenticazione File xmlexport-20231127-071916-1.zip – backup Confluence vuoto. Ripristinarlo cancellerà...

CVE-2026-76549

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

EUVD-2026-66877

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...