CVE-2026-65829

The MPXJ open-source library (versions 7.3.0 through 16.5.0 ) contains a path traversal vulnerability when processing Primavera P3 PRX or SureTrak STX files. A suitably crafted file can cause the library to write files to arbitrary locations in the filesystem. This issue is addressed in version 1...

CVE-2023-4220

CVE-2023-4220 PoC Chamilo LMS 認証なし大容量ファイルアップロードRCE このリポジトリには、Chamilo LMS に影響を与えるリモートコード実行 RCE 脆弱性である CVE-2023-4220 の概念実証 PoC が含まれています。この脆弱性により、認証されていない攻撃者が大容量ファイルのアップロード機能を悪用し、サーバー上で任意のコード実行を引き起こすことが可能になります。 索引 CVE-2023-4220 PoC - Chamilo LMS 認証なし大容量ファイルアップロードRCE 索引 脆弱性の詳細 免責事項 概要 LMSとは Chamiloとは...

CVE-2025-30208

CVE-2025-30208 検出ツール 脆弱性分析 Vite 任意ファイル読み取り脆弱性の分析と再現（CVE-2025-30208） 概要 本ツールは、対象システムに CVE-2025-30208 の脆弱性が存在するかどうかを検出するために使用されます。この脆弱性により、攻撃者は特定のパスを介してサーバー上の機密ファイル（/etc/passwd や C:\windows\win.ini など）を読み取ることができます。本ツールは単一 URL の検出とバッチ検出をサポートし、HTTP/HTTPS プロキシをオプションで使用できます。 ここで payload ?raw?? と...

CVE-2025-9215

StoreEngine 強力なWordPress eコマースプラグイン（支払い、メンバーシップ、アフィリエイト、販売など）= 1.4.0 - 認証済み（購読者以上）任意ファイルダウンロード StoreEngineプラグインのCSVインポート/エクスポート機能には、認証されたすべてのユーザー...

Cve-2025-8088-WinRar-vulnerability

Cve-2025-8088 WinRAR Python 製のツールで、WinRAR のCVE-2025-8088 脆弱性を悪用する悪意のあるRARファイルを作成します。CVE-2025-8088の脆弱性により、細工されたRARファイルを悪用してパストラバーサル を引き起こし、被害者のシステム上の任意のファイルを上書きすることが可能になります。 このプロジェクトは研究および教育目的のみです。本番環境や悪意のある目的で使用しないでください。 インストール リポジトリをcmd でクローンします: root@kitploit: git clone...

CVE-2023-4220

CVE-2023-4220 RCE Chamilo 1.11.24 | https://starlabs.sg/advisories/23/23-4220/ | | Chamilo LMS /tmp/rce.php EOF curl -F 'bigUploadFile=@/tmp/rce.php' "$HOST/$URLUPLD" CMD=$echo $CMD|base64 -w0| python3 -c "import urllib.parse,sys; printurllib.parse.quoteplussys.stdin.read" curl...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

tar: Tar path traversal

A flaw was found in GNU Tar. An attacker could exploit this vulnerability by providing two specially crafted TAR archives, if those archives were extracted in the same directory. The first archive contains a symbolic link that points to a critical directory. The second archive, when extracted, us...

tar: tar: Hidden file injection via crafted archives

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files...

Moderate: Red Hat Security Advisory: tar security, bug fix, and enhancement update

An update for tar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

CVE-2026-83963

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-84396

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in...

CVE-2026-81998

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-83962

Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-79906

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-77266

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

CVE-2026-77262

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2026-77259

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files,...