CVE-2023-22518

CVE-2023-22518 Exploit for Confluence CVE-2023-22518 backup-restore RCE Endpoint POST /setup/setup-restore.action Requires valid login and admin rights or an auth bypass Files xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!! Replace with any backup...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 References respect to the masters: CVE-2023-50386 vulnerability author's blog Java Security Manager Bypass Techniques Bypassing Reflection Protection in JDK 17 JNI Bypassing RASP Vulnerability exploitation...

Emlog 2.1.9 - SQL Injection

emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files. id: CVE-2023-39121 info: name: Emlog 2.1.9 - SQL Injection author: wjch611 severity: high description: |...

CVE-2024-44258

CVE-2024-44258: Symlink Vulnerability in ManagedConfiguration Framework Summary CVE-2024-44258 highlights a symlink vulnerability within the ManagedConfiguration framework and the profiled daemon in Apple devices. When restoring a crafted backup, the migration process fails to validate whether th...

CVE-2022-30075

CVE-2022-30075 Authenticated Remote Code Execution in Tp-Link Routers Affected Devices If your Tp-Link router has backup and restore functionality and firmware is older than june 2022, it is probably vulnerable Tested With Tp-Link Archer AX50, other tplink routers may use different format of...

CVE-2026-64824-PoC

CVE-2026-64824 — Path traversal por enlace simbólico en la copia de seguridad y restauración de Home Assistant Core → RCE CVSS 8.4 Crítico · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Un atacante autenticado admin sube un tar de copia de seguridad manipulado. La ruta de restauración extrae el...

reload.sh

reload.sh 请不要这样做... 请不要在运行中的系统上 （如生产环境）或存有重要数据的私人电脑 上执行此操作。 本方案展示了如何在已有系统运行的情况下安装全新系统。虽然非常酷炫且令人惊叹，但风险极高！ 如果你想踏入混乱的猴子领域，请继续阅读。 我为什么要创建它？ 我喜欢实验，因为我热衷于了解事物如何运作。它们让我理解并展示了某些更棘手的概念。 很久以前，这种方法救了我一命，但这确实疯狂。 它是如何工作的？ 针对 reload.sh 的初学者指南 PL 设置用于恢复的系统备份归档文件： root@kitploit: build="/mnt/system-backup.tgz"...

CVE-2026-81804

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration = 2.4.2 versions...

CVE-2025-43537

CVE-2025-43537 Apple Security Credit Researcher: Al Sadman Awal Officially credited by Apple Product Security for the responsible disclosure of CVE-2025-43537. Overview CVE-2025-43537 is a security vulnerability identified during independent security research and responsibly disclosed to Apple...

CVE-2026-1357

CVE-2026-1357 Lab Environment for CVE-2026-1357 1. Build the environment sudo apt update && sudo apt install docker.io docker-compose -y sudo systemctl start docker git clone Link of Repo wget https://downloads.wordpress.org/plugin/wpvivid-backuprestore.0.9.123.zip unzip...

halo-2.25.4-backup-write-CVE-2026-67920

Halo CMS Backup Restore Arbitrary File Write Vulnerability Summary A critical arbitrary file write vulnerability exists in the backup restoration functionality of Halo CMS versions up to 2.25.4. The restoreWorkdir method in MigrationServiceImpl.java copies the workdir/ directory from a...

CVE-2026-86748 Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism...

CVE-2026-78624

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

EUVD-2026-74172

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

CVE-2026-78624

Okta Access Gateway contains an improper path validation flaw in its backup restore function . The function does not validate the filename embedded in an encrypted backup payload, allowing file contents to be written to unintended locations on the appliance filesystem. The vulnerability is rated ...

CVE-2026-78624 Improper Path Validation in Okta Access Gateway Backup and Restore Functionality

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

CVE-2026-86733

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-55168

CVE-2026-55168 This repository contains a simple PoC for CVE-2026-55168 in Runtipi. The issue is an authenticated arbitrary file write that can be reached through the backup restore flow. A crafted backup archive can plant a symlink into restored application data, and a later normal config update...

EUVD-2026-72869

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...