CVE-2025-24104

CVE-2025-24104 ライトアップ: サンドボックス外のファイルの読み取り 私は Apple が後に CVE-2025-24104 として追跡したバグを報告しました。当初の報告では、悪意のあるバックアップを使用してサンドボックス制限をバイパスする方法を示しました。しかし、Apple の最初の説明では、この脆弱性は保護されたシステムファイルの改変につながる可能性があると述べられていました。ここで正しい情報を提供します。このバグは実際には、攻撃者がサンドボックスの外部にある任意のファイルを読み取ることを可能にします。 タイムライン 発見日: 2024年4月 報告日: 2024年10月...

nginx-ui-CVE-2026-42221-CVE-2026-42238-

nginx-ui CVE 検証環境 nginx-ui（Nginx の Web GUI 管理ツール）に報告された2つの CVE を、Docker 環境で実際に検証するためのリポジトリです。 CVE-2026-42221 : 未認証での管理者アカウント乗っ取り CVE-2026-42238 : 未認証バックアップ復元によるコマンド実行 免責事項 本リポジトリの検証内容は、自分が管理する隔離されたローカル環境のみを対象としています。 許可のない第三者のシステムへ同様の手法を使用することは不正アクセス禁止法に違反します。 詳細記事 検証の過程・考察・学んだことは Qiita 記事にまとめています...

drs-malware-scan

AWS 서비스를 사용한 온프레미스 서버의 악성코드 스캔 분석 수행 온프레미스 악성코드 탐지의 과제 보안팀이 예산 및 리소스 제약으로 인해 모든 온프레미스 서버를 지속적으로 모니터링하는 것은 어려울 수 있습니다. 최신 악성코드는 다양한 난독화 기술을 사용하므로 서명 기반 안티바이러스만으로는 충분하지 않습니다. 서버 관리자는 과거의 모든 서버에서 보안 이벤트를 볼 수 있는 가시성이 부족할 수 있습니다. 중앙 집중식 모니터링 및 알림 없이 사고 발생 시 손상된 시스템과 복원해도 안전한 백업을 판단하는 것은 어렵습니다. 서버 관리자가...

POC-CVE-2024-44258-Py

概念 PoC CVE-2024-44258: iOS のシンボリックリンクの脆弱性 要件: Python 3.7+ • ライセンス: MIT ⚠️ 警告: このリポジトリには、教育および研究のみ を目的として開発された概念実証（PoC）が含まれています。完全に機能するエクスプロイトではありません。適切な許可なくデバイスで使用することは禁止 されています。 目次 1. 概要 2. 脆弱性の詳細 3. 範囲と制限 4. PoCの特徴 5. 要件 6. 実装ガイド リポジトリのクローン 重要な設定 実行 理論的検証 7. 実際のエクスプロイト：主な課題 8. 利用条件と免責事項 9. ライセンス...

CVE-2026-81804

ZHBackup – Backup, Restore & Migration WordPress plugin versions up to and including 2.4.2 are affected by an unauthenticated Sensitive Data Exposure vulnerability. The flaw allows an attacker to retrieve sensitive data over the network without any prior authentication or user interaction. The CV...

CVE-2026-13336

CVE-2026-13336 is a CWE-78 (OS Command Injection) vulnerability identified by Schneider Electric (advisory SEVD-2026-223-02). The flaw allows execution of Linux operating system commands when a maliciously modified system backup is restored. The CVSS 4.0 score is 7.3 (HIGH) , with an adjacent net...

CVE-2026-13336

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified...

EUVD-2026-68156

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

PT-2026-83524

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging versions prior to 0.9.133 Description The backup restoration process fails to properly validate the destination paths of files extracted from a backup package. This creates a Zip Slip condition, which is a...

CVE-2026-19722: Improper Limitation of a Pathname to a Restricted Directory

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

CVE-2026-76549 UpdraftPlus < 1.26.7 - Backup Restoration via CSRF

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

CVE-2026-76549 UpdraftPlus < 1.26.7 - Backup Restoration via CSRF

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin < 1.26.7 - Backup Restoration vulnerability

Backup Restoration vulnerability discovered by Jashid Sany in WordPress Plugin UpdraftPlus versions 1.26.7...

CVE-2026-76549

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

PT-2026-82418

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

GO-2026-6259 Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero

Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero...

CVE-2026-73661: External Control of System or Configuration Setting

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...

CVE-2026-65917

CyberPanel

CVE-2026-65917 CyberPanel IncBackups IDOR via Sequential Backup ID

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...

CVE-2026-55410

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...