CVE-2025-24071

CVE-2025-24071PoC CVE-2025-24071: Fuga de hash NTLM a través de extracción RAR/ZIP y archivo .library-ms Windows Explorer inicia automáticamente una solicitud de autenticación SMB cuando se extrae un archivo .library-ms de un archivo .rar, lo que provoca la divulgación del hash NTLM. El usuario n...

CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

EUVD-2026-87981

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101056 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a contexthint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zer...

CVE-2026-101056

Cloudreve versions prior to 4.16.1 are vulnerable to an authentication bypass caused by a failure to revalidate share access when restoring cached navigator state from a context_hint UUID . An attacker who previously held valid share access can replay the cached hint to generate signed file URLs ...

CVE-2026-101051

Cloudreve versions prior to 4.16.1 are vulnerable to a path traversal flaw during remote downloads. The application fails to properly sanitize file paths returned by remote downloaders, which allows authenticated users to exploit path traversal sequences in downloader metadata. This enables an at...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

EUVD-2026-87980

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

Job-Manager-Disclosure

CV Filename Disclosure Scanner – CVE-2015-6668 Este script automatiza la búsqueda de archivos de CV como .jpg, .png, .jpeg expuestos públicamente mediante la vulnerabilidad CVE-2015-6668, relacionada con el plugin WP Job Manager para WordPress versiones ≤ 0.7.25. 🧠 Descripción La vulnerabilidad...

CVE-2021-42671

CVE-2021-42671 CVE-2021-42671 - Vulnerabilidad de control de acceso roto en el sistema de portal en línea de ingenieros. Descripción técnica: Existe una vulnerabilidad de control de acceso roto en el Portal en línea de ingenieros. Un atacante puede aprovechar esta vulnerabilidad para eludir los...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Antecedentes Script de prueba de concepto PoC para el complemento de WordPress Bit File Manager versión = 6.5.7, vulnerabilidad de carga limitada de archivos JavaScript autenticada suscriptor+ CVE-2024-8743 Información Descripción: El complemento de WordPress Bit File Manager –...

CVE-2025-47577

CVE-2025-47577 Un proof of concept desarrollado para explotar CVE-2025-47577. Basado en el artículo de PatchStack. Uso usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of th...

AutoPwn-Titanic.htb

Titanic AutoPWN - Máquina HTB Este es un script de explotación automatizada para la máquina Titanic de Hack The Box. Un script completo de automatización de explotación para la máquina Linux Titanic HTB en Hack The Box. Guía completa - WriteUp.md 📋 Descripción Realiza las siguientes acciones: Fas...

CVE-2018-11235

CVE-2018-11235 Resumen de la vulnerabilidad Nombre de la vulnerabilidad: Vulnerabilidad de seguridad de Git ID CNNVD: CNNVD-201805-1020 Nivel de peligro: Alto ID CVE: CVE-2018-11235 Tipo de vulnerabilidad: Problema de característica de seguridad Fecha de publicación: 2018-05-31 Tipo de amenaza:...

CVE-2025-7775

CVE-2025-7775 Detección de versiones PowerShell También hay un método genial basado en hash de archivo: https://github.com/fox-it/citrix-netscaler-triage/blob/main/scan-citrix-netscaler-version.py También puedes potencialmente usar los binarios del cliente para enumerar la versión no estoy seguro...

log4j-scanner

log4j-scanner Escáner de vulnerabilidad Log4j 2 CVE-2021-44228 para el sistema operativo Windows. Ejemplo de uso Uso .\log4j-scanner.exe La terminal se utiliza para mostrar los resultados. Despliegue esta herramienta en máquinas mediante RMM e inicie/reporte desde PowerShell o el Símbolo del...

Penetration-Testing-Tools

Una colección de mis herramientas, scripts y cheatsheets de pruebas de penetración Esta es una colección de más de 160+ herramientas, scripts, cheatsheets y otros botines que he estado desarrollando durante años para pruebas de penetración y auditorías de seguridad informática. La mayoría de ello...