cve-2025-59532-poc

CVE-2025-59532 Docker環境 CVE-2025-59532を分析するためのDockerベースの研究環境です。これはOpenAI Codex CLIにおけるパストラバーサル脆弱性であり、意図されたワークスペースサンドボックス外への任意のファイル書き込みを可能にします。 CMUのコースの一部：2025年秋学期「18-739 ハッキングとオフェンシブセキュリティ」 はじめに リポジトリのクローン まず、このリポジトリをクローンします： root@kitploit: git clone...

CVE-2026-37068

CVE-2026-37068 Veno File Manager Project 4.4.9の/vfm-admin/index.php?section=translations&action=updateにおける任意のファイル書き込みにより、スーパー管理者の役割を持つ認証済みユーザーが、影響を受けるエンドポイントへの特別に細工されたPOSTリクエストを介して、アプリケーション内の任意のphpファイルを上書きできる可能性があります。...

CVE-2026-17106

CVE-2026-17106 — CopyEscape:docker cp 容器到宿主机的任意文件写入 HackSpeak 分发镜像。本仓库为 Imperva 红队Ron Masas公开的 CopyEscape PoCCVE-2026-17106的分发镜像 ,代码与上游一致;上游未附 LICENSE,镜像按分发惯例采用 MIT License,Copyright c 2026 HackSpeak ,源码版权归原代码作者。 ⚠️ 仅供安全研究与授权测试使用 ;Linux 演示会覆盖/usr/bin/runc,请在一次性 VM 中运行并先做可验证的备份 ,勿在未授权或生产环境执行。 漏洞简述...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 —— TECNO Hi 浏览器下载处理器中的路径遍历漏洞 这是针对 CVE-2026-18907 （CVSS 7.5 High，CWE-23）的概念验证（PoC），该漏洞是 TECNO Hi Browser （com.talpa.hibrowser）2.23.1.1 版本下载文件功能 中的一个相对路径遍历漏洞。浏览器信任由攻击者控制的 Content-Disposition 文件名，并将其拼接到下载目录中，既未净化路径分隔符，也未对结果进行规范路径检查——因此文件名中的 ../ 序列可使响应体被写入 Download/ 目录之外、浏览器存储权限所允许的任何路...

CVE-2026-23751-poc

CVE-2026-23751-PoC Proof-of-concept implementation of the .NET HTTP Remoting technique described in Code White's NewRemotingTricks, targeting Tungsten Automation Kofax Capture. CVE-2026-23751 Title: Tungsten Automation Kofax Capture Unauthenticated File Read/Write and Command Execution via .NET...

CopyEscape-CVE-2026-17106

CopyEscape：利用 docker cp 接管 Docker 主机（CVE-2026-17106） 这是博客文章 CopyEscape：利用docker cp 接管 Docker 主机 — CVE-2026-17106 的概念验证（PoC）仓库。 CopyEscape 可让恶意运行的容器与 Docker 的归档生成器竞争，从而创建不一致的 tar 流。随后，存在漏洞的 Docker CLI 会在提取过程中跟随被植入的符号链接，并写入运行 docker cp 的用户所选本地目标之外的位置。 该仓库包含两个演示： macos/ 包含一个非破坏性的 Docker Desktop 演示，它...

CVE-2025-7401

CVE-2025-7401 Premium Age Verification / Restriction for WordPress = 3.0.2 - Lectura y escritura arbitraria de archivos no autenticada 🧾 Premium Age Verification / Restriction for WordPress = 3.0.2 — Lectura y escritura arbitraria de archivos no autenticada 📝 Descripción El plugin "Premium Age...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-87984

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

EUVD-2026-76129

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 are affected by an unauthenticated arbitrary file write vulnerability in the sync_server daemon listening on TCP port 13136 . The daemon runs as root without authentication and accepts a 100-byte filename field in its pro...

EUVD-2026-76119

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-87984

Mistral Vibe , introduced in version 1.3.4 , contains an arbitrary file write vulnerability. The root cause is that shell redirection destinations are omitted from permission checks , allowing otherwise allowlisted commands to create or overwrite files at arbitrary paths accessible to the Vibe pr...

CVE-2026-87984

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-82583

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier are affected by a SQL injection vulnerability exploitable through the Database Connector API by an authenticated user with low privileges. The flaw can lead to disclosure of stored credentials for connected systems, arbitrary file write ,...

CVE-2026-82583 NextGen Healthcare Mirth Connect SQL Injection

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

EUVD-2026-76115

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

CVE-2026-18953

CVE-2026-18953 — PoC 通过 awslabs.aws-transform-mcp-server （AWS Transform MCP 服务器）中 getresource 工具的 savePath 参数实现任意文件写入。 | ---|--- CVE| CVE-2026-18953 CWE| CWE-22 — 对受限目录的路径名限制不当 受影响版本| awslabs.aws-transform-mcp-server 0.1.0 – 0.1.4 修复版本| 0.1.5 CVSS v3.1| 8.6 高危 — AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF Arbitrary File Write to RCE PoC Derivation Process and Reflection Scope: This content is intended solely for local test environments, authorized reproduction environments, vulnerability verification, and protection rule analysis. Do not use...

CVE-2025-8110

CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC 针对 CVE-2025-8110 的 PoC：Gogs ≤ 0.13.3 存在经过身份验证的任意文件写入漏洞，根源在于 PutContents API 对符号链接的处理不当。 经过身份验证的用户可以提交一个指向 .git/config 的符号链接，然后使用该 API 覆盖它并注入恶意的 sshCommand，从而实现远程代码执行。 免责声明 仅用于教育和授权测试。请勿对非您所有或未经明确许可的系统使用。 用法 root@kitploit: chmod +x poc.sh ./poc.sh \ -i \ -P \ ...