CVE-2022-30075

CVE-2022-30075 Ejecución remota de código autenticada en routers Tp-Link Dispositivos afectados Si tu router Tp-Link tiene funcionalidad de copia de seguridad y restauración y el firmware es anterior a junio de 2022, probablemente sea vulnerable. Probado con Tp-Link Archer AX50, otros routers...

Emlog 2.1.9 - SQL Injection

emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files. id: CVE-2023-39121 info: name: Emlog 2.1.9 - SQL Injection author: wjch611 severity: high description: |...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 参考（向dalao们致敬）： CVE-2023-50386漏洞作者博客 Java Security Manager绕过姿势 JDK 17下的反射保护绕过 JNI绕Rasp 漏洞利用原理和思考：https://mp.weixin.qq.com/s/mO4e8aiuL56yBdOD4jy2qQ poc是用Pocsuite3写的，直接用框架运行即可，若不使用框架，则提取其核心实现出来也可以...

CVE-2026-55168

CVE-2026-55168 本仓库包含一个针对 Runtipi 中 CVE-2026-55168 的简单 PoC。 该问题是一个可通过备份恢复流程触发的经过身份验证的任意文件写入。精心构造的备份压缩包可以在恢复的应用数据中植入符号链接，随后正常的配置更新会跟随该符号链接，将攻击者控制的内容写入预期目录之外。 参考公告： https://github.com/runtipi/runtipi/security/advisories/GHSA-wcrf-g9p9-2wg7 受影响版本： /data/state/proof.txt 之后，更新应用配置的常规请求会导致 Runtipi...

CVE-2023-33781

CVE-2023-33781 描述 D-Link DIR-842V2 v1.0.3 被发现允许用户在连接 telnet 时运行任意二进制文件。此漏洞可通过备份/恢复功能触发。 概念验证...

CVE-2023-22518

CVE-2023-22518 Confluence CVE-2023-22518 のエクスプロイト backup-restore RCE エンドポイント POST /setup/setup-restore.action 有効なログインと管理者権限 または認証バイパス が必要です ファイル xmlexport-20231127-071916-1.zip – 空の Confluence バックアップです。これを復元すると全データが削除されます!!! 任意のバックアップに置き換えてください; スクリプトと同じフォルダに配置してください。 shellplug.jar –...

CVE-2023-5808

CVE-2023-5808 CVE-2023-5808 es una vulnerabilidad de Referencia Directa a Objetos Insegura IDOR encontrada en la funcionalidad de Backup & Restore de la Unidad de Gestión del Sistema SMU de Hitachi NAS HNAS. Esta vulnerabilidad afecta a las versiones de SMU anteriores a 14.8.7825.01. Explotación...

SparstanBoogie

SparstanBoogie 的起源据称在 iOS/iPadOS 15.2 - 16.7 RC 20H18 和 17.0 上进行了测试，然而实际测试已进行到 26.1 26.1 的设备上进行测试。此外，也欢迎在高于或低于已报告版本的设备上进行测试，因为它可能在新设备上再次出现，因此没有理由拒绝任何愿意报告此工具对其是否有效的善意测试者。据称不受此工具所源自的“前代”程序支持的旧设备，已被发现受到影响，例如 iOS 15.8.7。 据报道，根据如实的漏洞披露，该问题已通过改进符号链接处理得到解决。该问题据称已在 iOS 17.7.1 和 iPadOS 17.7.1、iOS 18.1 和...

CVE-2026-55168

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

EUVD-2026-64143

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168

Runtipi (personal homeserver orchestrator) versions 4.10.0 and earlier are vulnerable to an authenticated arbitrary file write via symlink planting during the backup restore flow. An attacker with valid credentials can craft a backup archive containing a symlink (e.g., user-config/app.env pointin...

NocoBase backup restore schema name allows command injection

Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...

Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...

GHSA-J2G6-362Q-6QC6 Velero vulnerable to file path traversal when extracting from backup's tarball

Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...

EUVD-2026-63474

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-76635

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-76635

baserCMS before 5.3.0 is vulnerable in BcDatabaseService.php, where authenticated administrators can inject attacker-controlled table names and configuration values directly into SQL statements across sequence-update, CSV-export, and table-management operations. This chains with a backup-restore ...

CVE-2026-76635 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...