EUVD-2026-95122

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

Demonstration-of-CVE-2023-38831-via-Reverse-Shell-Execution

CVE-2023-38831 Reverse Shell Demonstration This repository contains a PDF summary and screenshots of a lab-based demonstration of CVE-2023-38831. The vulnerability allows attackers to embed and execute malicious payloads in compressed files. In this case, the payload triggers a reverse shell...

Rocky Linux 9 [CIQ] Security Update: fontforge / fontforge-debuginfo / fontforge-debugsource Multiple Vulnerabilities (crlsa-2024_9439)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249439 advisory. fontforge: command injection via crafted archives or compressed files CVE-2024-25082 fontforge: command injection via crafted filenames CVE-2024-25081...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection through crafted archives or compressed files...

EUVD-2026-49136

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...

Uncontrolled Resource Consumption

phpoffice/phpspreadsheet is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the Gnumeric reader calling gzdecode on attacker-supplied compressed .gnumeric files without enforcing a decompressed-size limit, which allows an attacker to upload a specially crafted...

Gradio Vulnerable to Denial of Service (DoS) via Crafted Zip Bomb

A vulnerability in the dataframe component of gradio-app/gradio version git 98cbcae allows for a zip bomb attack. The component uses pd.readcsv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server...

EUVD-2026-37998

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed ...

fontforge: command injection via crafted archives or compressed files

Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files...

EUVD-2025-202310

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/storage and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable conten...

EUVD-2015-9385

Malware in sbrugna...

EUVD-2020-18153

Malware in sbrugna...

EUVD-2006-4826

Malware in sbrugna...

EUVD-2007-2761

Malware in sbrugna...

EUVD-2024-32094

Malicious code in bioql PyPI...

EUVD-2022-52462

Malicious code in bioql PyPI...

EUVD-2024-2609

Malicious code in bioql PyPI...

EUVD-2022-52143

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-4883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on th...

HortusFox 安全漏洞

HortusFox is a free and open source self-hosted plant manager system from HortusFox, Inc. A security vulnerability exists in HortusFox version v4.4, which stems from improper handling of compressed files by the /modules/ImportModule.php component and could lead to arbitrary code execution...