satellite

satellite Satellite is an web payload hosting service which filters requests to ensure the correct target is getting a payload. This can also be a useful service for hosting files that should be only accessed in very specific circumstances. Quickstart Guide 1. Install satellite on Ubuntu using th...

pwndrop

pwndrop 是一个可自行部署的文件托管服务，用于发送红队测试负载，或通过 HTTP 和 WebDAV 安全地分享你的私人文件。 如果你曾经需要快速搭建一个 nginx/apache 服务器来托管文件，却对 python -m SimpleHTTPServer 的限制感到不满，那么 pwndrop 绝对适合你！ 使用 pwndrop ，你可以： 通过拖放操作，立即上传并分享多个文件到自己的私有 VPS 上。 一键决定文件是否可供下载。 为共享文件设置自定义下载 URL，无需摆弄目录结构。 设置伪装文件，当你需要时，它会替代原始文件被提供。 设置自动重定向，以伪造共享链接中的文件扩展名。...

pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

Malicious code in ndmfguyhoxc3 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-10622 Malicious code in chai-as-structured (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9508b72d48575443d9e68f1da1ef6bdd1ebc9351f271fba56b563701f03e56e2 The package name evokes chai-as-promised but the shipped code presents itself as pino middleware. When the middleware factory in index.js is invoked,...

SUSE CVE-2026-25242

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any remote user can upload arbitrary files to the server via /releases/attachments and...

CVE-2026-25242

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any remote user can upload arbitrary files to the server via /releases/attachments and...

CVE-2026-25242 Gogs allows unauthenticated file uploads

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any remote user can upload arbitrary files to the server via /releases/attachments and...

CVE-2026-25242 Gogs allows unauthenticated file uploads

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any remote user can upload arbitrary files to the server via /releases/attachments and...

PT-2026-20323

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.1 Gogs versions 0.13.4 and below Description Gogs, an open-source self-hosted Git service, allows unauthenticated file uploads by default. When the RequireSigninView setting is disabled which is the default...

Soliton Systems Kk FileZen 安全漏洞

Soliton Systems Kk FileZen is a file hosting device developed by the Japanese company Soliton Systems Kk. This device offers functions such as file storage, file transfer, and upload/download capabilities. There is a security vulnerability present in Soliton Systems Kk FileZen; this vulnerability...

EUVD-2026-5001

LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without needing an internet connection. In versions up to and including 1.17.0, when a user initiates a "Share via Link" session, the LocalSend application starts a loca...

YetiShare File Hosting Script security vulnerability

YetiShare File Hosting Script is a file hosting system provided by the British company YetiShare. Version 5.1.0 of YetiShare File Hosting Script contains a security vulnerability. This vulnerability stems from a server-side request forgeing issue in the remote file upload function, which may lead...

CVE-2024-58313

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the filehosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif,...

EUVD-2024-55343

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the filehosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif,...

CVE-2024-58313

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the filehosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif,...

CVE-2024-58313 xbtitFM 4.1.18 Insecure File Upload in file_hosting Feature

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the filehosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif,...

CVE-2024-58313 xbtitFM 4.1.18 Insecure File Upload in file_hosting Feature

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the filehosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif,...

CVE-2024-58313

CVE-2024-58313 affects xbtitFM 4.1.18 and describes an insecure file upload in the file_hosting feature. The root cause is a bypass of file-type checks through Content-Type header manipulation (image/gif), GIF89a bytes, and alternate PHP tags, enabling authenticated attackers with administrative ...

xbtitFM 代码问题漏洞

xbtitFM is a BitTorrent tracker software by the individual developer of xbtitFM. A code issue vulnerability exists in xbtitFM version 4.1.18, which stems from an insecure file upload in the filehosting function that could lead to the execution of arbitrary PHP code...