CVE-2026-55168

CVE-2026-55168 Este repositorio contiene un PoC simple para CVE-2026-55168 en Runtipi. El problema es una escritura arbitraria de archivos autenticada que se puede alcanzar a través del flujo de restauración de copias de seguridad. Un archivo de copia de seguridad manipulado puede colocar un enla...

CVE-2026-39023

CVE-2026-39023 RCE poc - RESPONSIVE filemanager v.9.14.0 最后一个版本 - 未修补 Github 项目：https://github.com/trippo/ResponsiveFilemanager 要求：无需任何条件，此漏洞利用无需认证。 Responsive Filemanager 应用是一个基于 Web 的文件管理工具，用于管理服务器上的文件。此漏洞（CVE-2026-39023）允许攻击者利用重复文件创建 PHP 文件，从而导致在目标系统上远程执行代码。...

EUVD-2026-89022

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...

EUVD-2026-89019

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...

CVE-2026-19743

The TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 are vulnerable to a Path Traversal flaw in the local IPC service. Due to improper path validation, a local authenticated user with low privileges can send crafted IPC commands to the service daemon to manipula...

CVE-2024-31969

📌 CVE-2024-31969 CVE-2024-31969 adalah kerentanan local privilege escalation pada sudo ketika menggunakan perintah sudoedit. Kerentanan ini diperkenalkan sejak sudo 1.9.0 karena cara sudoedit memvalidasi environment variable pengguna dan kepemilikan file yang kurang tepat. 📖 Deskripsi A flaw...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601

The Flysystem PHP file storage library is vulnerable in versions prior to 3.35.3 due to a flaw in the WhitespacePathNormalizer component. The root cause is that preg_match with the u modifier treats false (returned during malformed UTF-8 input) as falsy, allowing paths containing control characte...

EUVD-2026-88998

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102601 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...

CVE-2026-102598 Werkzeug safe_join() allows Windows special device names

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...

CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: Optimole WordPressプラグインにおけるCSRFから任意ファイル上書きへの脆弱性 概要 WordPress用Optimoleプラグイン（バージョン4.2.5以下）におけるクロスサイトリクエストフォージェリ（CSRF）の脆弱性により、nonce検証の欠如のため、認証されていない攻撃者がwpajaxoptmlreplacefile AJAXアクションを介して既存のメディアライブラリアセットをサイレントに上書きすることが可能です。 CVE ID : CVE-2026-11784 脆弱性タイプ : クロスサイトリクエストフォージェリ（CSRF）...

CVE-2026-43637-cornac

CVE-2026-43637：Cornac 中 extractarchive 的路径遍历（Tar Slip）漏洞 严重性： 高危，CVSS 4.0 8.8 ；严重，CVSS 3.1 9.1 （由 VulnCheck（CNA）指定） 向量（v4.0）： CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N 向量（v4.0）： CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 受影响版本： cornac 2.6.0 修复版本： 2.6.0 CWE：...

CVE-2026-48908-joomla-sp-page-builder-detection

CVE-2026-48908 — Joomla SP Page Builder 検証と検知 Joomla SP Page Builder コンポーネントにおけるCVE-2026-48908の実験室検証。技術的証拠、イベント再構築、防御的検知の機会に焦点を当てています。 このリポジトリは、SP Page Builder の asset.uploadCustomIcon エンドポイントが、Joomla...

CVE-2026-56291

自動スキャンバージョン & エクスプロイト CVE-2026-56291 POC Joomla Balbooa Formsにおける未認証の任意ファイルアップロードによるRCE FOFA / Shodan FOFA: body="combaforms" Shodan: http.html:"baforms"...

gstreamer-plugins-good: GStreamer: Remote code execution via MRF file parsing

A flaw was found in GStreamer. This out-of-bounds write vulnerability occurs during the parsing of MRF files due to improper validation of user-supplied data. A remote attacker could exploit this by tricking a user into visiting a malicious page or opening a malicious file. Successful exploitatio...

Important: Red Hat Security Advisory: gstreamer1-plugins-good security update

An update for gstreamer1-plugins-good is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A...

CVE-2026-48282-coldfusion-rds-detection

CVE-2026-48282 — Adobe ColdFusion RDS 検証と検出 Adobe ColdFusion Remote Development Services RDS における CVE-2026-48282 のラボ検証。技術的証拠、イベント再構築、防御的検出の機会に焦点を当てています。 このリポジトリは、脆弱なRDS...

wordpress-rce-vapt-cve-2020-25213

WordPress RCE 利用与缓解措施 CVE-2020-25213 📌 项目概述 本项目是为 IE4012 – 进攻性黑客战术与策略 模块开发的。 它在受控实验环境中演示了完整的网络安全攻击生命周期，包括： 社会工程攻击 恶意软件模拟 漏洞利用 VAPT 分析 安全补丁实施 🎯 目标漏洞 CVE 编号： CVE-2020-25213 漏洞： WordPress 文件管理器插件远程代码执行 严重性： 严重 CVSS 9.8 类型： 未认证文件上传 → 远程代码执行 🧪 实验环境 角色| 操作系统| IP 地址 ---|---|--- 攻击者| Kali Linux| x.x.x.x...

public-passwd

!WARNING 请仅在你拥有或获授权测试的系统上使用。如果你在失败时无法重启系统，建议保持一个 root shell 打开，因为如果没有 root，你可能无法清除 /etc/shadow 的页缓存。 public-passwd 利用 CVE-2026-46333 和 CVE-2026-31431，无需提升到 root 即可更改任意用户的密码。 使用方法 python passwd.py 你也可以不带参数运行该命令，以查看 shadow 文件中当前的哈希。 截图 工作原理 CopyFail（CVE-2026-31431）及类似漏洞允许向操作系统中你可读取的任何文件写入 4...