EUVD-2026-96778

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

CVE-2026-108540 OpenSpug File Transfer transfer os command injection

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The...

CVE-2026-104028

The Anton Extensions WordPress plugin, in versions up to and including 1.2.2 , is vulnerable to an unauthenticated arbitrary file upload. The flaw exists because the plugin fails to perform capability checks , nonce verification , or file-type validation when writing attacker-supplied content to ...

EUVD-2026-96738

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

CVE-2026-104028 Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code...

CVE-2025-9074-PoC-Bash

CVE-2025-9074-PoC-Bash The original PoC is: https://github.com/j3r1ch0123/CVE-2025-9074. This is new PoC in bash since not all docker containers has python installed, and mostly this should be run from inside a container. Steps From inside the container use the following to find vulnerable docker...

pftriage

pftriage pftriage es una herramienta para ayudar a analizar archivos durante el triaje de malware. Permite a un analista ver y extraer rápidamente propiedades de un archivo para ayudar durante el proceso de triaje. La herramienta también tiene una función de análisis que puede detectar indicadore...

santa

Santa Santa ist ein Autorisierungssystem für Binärdateien und Dateizugriffe unter macOS. Es besteht aus einer Systemerweiterung, die Ausführungen und Dateizugriffe überwacht und Entscheidungen auf der Grundlage der Inhalte einer lokalen Datenbank trifft, einem GUI-Agenten, der den Benutzer im Fal...

CVE-2025-24071

CVE-2025-24071 - Windows File Explorer NTLM Hash Leak 📋 Overview CVE-2025-24071 is a vulnerability in Windows File Explorer that allows unauthorized disclosure of NTLM hashes. When a user extracts a specially crafted .zip archive containing a malicious .library-ms file, Windows Explorer...

wphardening

WPHardening Fortalezca la seguridad de cualquier instalación de WordPress. ❮ NOTA ❯ Esta herramienta publica nuevas versiones de forma regular. Asegúrese de actualizar sus dependencias con frecuencia para obtener la última versión. Consulte el registro de cambios o CHANGELOG.md para conocer las...

GZDoom-Arbitrary-Code-Execution-via-ZScript-PoC

GZDoom = 4.13.1 Arbitary Code Execution via Malicious ZScript A proof of concept for an arbitrary code execution vulnerability I found in GZDoom's https://github.com/zdoom/gzdoom ZScript functionality. An attacker can share a PK3 file containing a malicious ZScript source file and gain access to...

CVE-2024-2961

CVE-2024-2961 Uses CVE-2024-2961 to perform an arbitrary file read Usage Use with wrapwrap for maximum potency. usage: arbitrary-file-read.py -h -t TARGET -c CHAIN -ct CONTENTTYPE --prefix-len PREFIXLEN --suffix-len SUFFIXLEN options: -h, --help show this help message and exit -t TARGET, --target...

CVE-2024-31835

CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...

cve-2026-16219-croogo-lab

CVE-2026-16219: Croogo FileManager defensive lab This repository documents and safely demonstrates the path-authorization flaw tracked as CVE-2026-16219 in Croogo CMS. It is intended for defenders, maintainers, students, and researchers testing systems they own or are explicitly authorized to...

CVE-2024-32258

Overview CVE ID : CVE-2024-32258 Type : Path Traversal Vendor : FCEUX Products : FCEUXNetPlay Version : 2.7.0 Fix : 48b48e7c13be1b949074f42660a33c7ef57135e1 Description FCEUX is a NES Emulator that can take us back to our childhood. It provides multiple interesting features, such as two players...

CVE-2024-24919

CVE-2024-24919 An Vulnerability detection and Exploitation tool for CVE-2024-24919 Installation: git clone https://github.com/RevoltSecurities/CVE-2024-24919 pip install -r requirements.txt python3 exploit.py --help Usage: python3 exploit.py -h / / / / / / / / | |// // / / / / / / / / / / / / /...

LFI-Destruction

🔥 LFI-Destruction – Authorized Penetration Testing Framework LFI-Destroyer is a comprehensive, modular Local File Inclusion LFI exploitation framework designed for authorized security professionals. It combines multiple attack techniques into a single, easy‑to‑use tool: SSH & Browser Artifact...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 es una herramienta de descubrimiento de subdominios que encuentra y resuelve subdominios válidos y luego realiza fuzzing de SSRF/LFI/SQLi, fuerza bruta y escaneo de puertos. Tiene una...

tscopy

TScopy Actualizado 2022-03-31 Presentando TScopy Durante un compromiso de Respuesta a Incidentes IR, es necesario tener la capacidad de analizar archivos en el sistema de archivos. A veces, estos archivos están bloqueados por el sistema operativo SO porque están en uso, lo que es particularmente...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: A re-implementation of https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py Uses uuids as part of the requested filename to avoid remote server crashing after first path traversal exploitation. run.py / shell.py: wrapper on top of podman to run...