vm-filesystem

vm-filesystem 一个Firebeam字节码，用于执行文件系统交互，同时对Havoc界面文件浏览器交互的Python函数进行猴子补丁，从而允许与远程文件系统交互，而无需嵌入文件系统。 该仓库也展示了通过Firebeam虚拟机及客户端本身的模块化能力所能实现的功能，通过猴子补丁函数，允许从agent控制台和用户界面使用替代的文件系统交互方法。 视频演示 猴子补丁实现字节码执行 该脚本将对文件浏览器用于向agent下发任务的方法进行猴子补丁，并将其替换为通过替代方法对等效任务进行字节码解释和执行，从而展示操作员和外部工具可用的能力。...

CVE-2024-6651

CVE-2024-6651 POC XSS - CVE-2024-6651 针对 CVE-2024-6651 漏洞的可运行 PoC，该漏洞影响 WP File Upload 4.24.8 插件，允许在 WordPress 中执行反射型跨站脚本（XSS）。 📌 描述 该漏洞允许通过 WP File Upload 插件管理面板中一个未经清理的参数注入任意 JavaScript 代码。 攻击通过 File Browser 功能中的 dir 参数发生，允许在已认证用户（通常是管理员）的浏览器中执行 JavaScript。 ⚠️ 仅供教育目的和授权环境使用 。 🧠 漏洞类型 反射型 XSS 🧰 要求...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

CVE-2019-6447

CVE-2019-6447 上述对ES文件浏览器安全漏洞的调查让我们能够全面了解该问题。...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS命令注入 PoC English version 概述 此仓库是 File Browser （版本 2.0.0 至 2.33.1）中发现的一个严重 OS 命令注入漏洞 CVE-2026-35585 的概念验证（PoC）。 该漏洞存在于“自定义命令钩子”功能中。由于在 shell 执行时，诸如 $FILE 或 $USERNAME 等环境变量未能得到充分清理，拥有文件上传权限的已认证用户可能利用恶意文件名在主机系统上执行任意命令。 发现者: saku0512 https://github.com/Saku0512 ⚠️ 免责声明...

CVE-2026-54088-poc

CVE-2026-54088: 认证钩子的Shell替换导致命令注入（预认证RCE） English version 概要 此仓库是 File Browser 版本 = 2.63.5 中存在的一个严重OS命令注入漏洞 CVE-2026-54088 的 Proof of Concept PoC。 该漏洞存在于 Hook Authentication 功能中。当管理员配置 File Browser 使用外部命令进行用户认证时，登录时提交的 username 和 password 会被未经转义地通过 os.Expand 展开到已配置的命令字符串中。未认证的远程攻击者可以通过登录请求注入 She...

CVE-2026-90929

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-90930

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link...

CVE-2026-90928

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

EUVD-2026-77448

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link...

CVE-2026-90930

File Browser through version 2.63.23 is vulnerable to a path rule bypass via symbolic link resolution. The application applies access-control path rules to the requested lexical path but fails to reapply those rules after resolving symbolic links to their actual targets. This allows authenticated...

CVE-2026-90930 File Browser through 2.63.23 Path Traversal via Symlink Alias

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link...

CVE-2026-90930 File Browser through 2.63.23 Path Traversal via Symlink Alias

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link...

CVE-2026-90929 File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-90929

File Browser versions 2.5.0 through 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS handler, the direct-upload path does not reject a target that is an existing directory. A POST with ?override=true aimed at a...

EUVD-2026-77447

File Browser versions = 2.5.0 and = 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint resourcePostHandler in http/resource.go. Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true...

CVE-2026-90928 File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

CVE-2026-90928

File Browser through 2.63.23 contains a memory exhaustion vulnerability in its subtitle conversion endpoint . The endpoint loads entire subtitle files (.srt, .ass, .ssa) into memory without imposing size limits. An authenticated attacker with download permission can request conversion of large su...

EUVD-2026-77446

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...

CVE-2026-90928 File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust serv...