CVE-2026-89713

In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate permission under inode lock nfsdsetattr checks whether a size update needs NFSDMAYTRUNC before it takes inodelock. The comparison uses the file size sampled by that unlocked read, but the actual ATTRSIZE upda...

PT-2026-91122

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

CVE-2025-66034

CVE-2025-66034 — fontTools varLib 任意文件写入 → 远程代码执行 针对fontTools.varLib 中任意文件写入 + XML 注入漏洞的 PoC 利用 已测试于 HackTheBox — VarIaType 漏洞 fontTools.varLib 处理 .designspace XML 文件以构建可变字体。两个弱点组合实现了未授权远程代码执行： | 原语| 详情 ---|---|--- 1| 通过 CDATA 分割实现的 XML 注入| 攻击者控制的 内部内容被逐字写入输出字体文件主体，允许注入任意数据 2| 通过os.path.join...

collisions

TL;DR 让这两张图片发生 MD5 碰撞现在 轻而易举且即时。 ⟷ 不要玩火，不要依赖 MD5。 碰撞任意一对文件在很多年前就已可行，但每次需要数小时，且没有捷径。 本页面提供了针对特定文件格式的技巧以及预计算的碰撞前缀，使碰撞可以即时 完成。 git clone. 运行脚本。完成。 哈希碰撞与利用 作者：Ange Albertini 和 Marc Stevens。 简介 状态 攻击 相同前缀 FastColl MD5 UniColl MD5 Shattered SHA1 选择前缀碰撞 HashClash MD5 Shambles SHA1 攻击总结 利用 标准策略 JPG 自定义扫描...

dirtycaw-projet

Dirty COW - Privilege Escalation CVE-2016-5195 This project demonstrates a privilege escalation using the Dirty COW vulnerability in a virtual machine with Ubuntu Server 16.04.1 and kernel 4.4.0-31-generic. 🔧 Environment Victim machine : Ubuntu 16.04.1 vulnerable student without privileges Attack...

WordPress Core <=6.2 - Directory Traversal

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wplang’ parameter. id: CVE-2023-2745 info: name: WordPress Core =6.2 - Directory Traversal author: nqdung2002 severity: medium description: | WordPress Core is vulnerable to Directory Traversal in...

Gladinet CentreStack & TrioFox - Local File Inclusion

In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended disclosure of system files. Exploitation of this vulnerability has been observed in the wild. This issue impacts Gladinet CentreStack and...

Suprema BioStar <2.8.2 - Local File Inclusion

Suprema BioStar before 2.8.2 Video Extension allows remote attackers can read arbitrary files from the server via local file inclusion. id: CVE-2020-15050 info: name: Suprema BioStar 2.8.2 - Local File Inclusion author: gy741 severity: high description: Suprema BioStar before 2.8.2 Video Extensio...

Pallets Werkzeug <0.15.5 - Local File Inclusion

Pallets Werkzeug before 0.15.5 is susceptible to local file inclusion because SharedDataMiddleware mishandles drive names such as C: in Windows pathnames. id: CVE-2019-14322 info: name: Pallets Werkzeug 0.15.5 - Local File Inclusion author: madrobot severity: high description: | Pallets Werkzeug...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion

Cisco Linksys WVC54GCA 1.00R22/1.00R24 is susceptible to local file inclusion in adm/file.cgi because it allows remote attackers to read arbitrary files via a %2e. encoded dot dot or an absolute pathname in the nextfile parameter. id: CVE-2009-1558 info: name: Cisco Linksys WVC54GCA 1.00R22/1.00R...

FHEM 6.0 - Local File Inclusion

FHEM version 6.0 suffers from a local file inclusion vulnerability. id: CVE-2020-19360 info: name: FHEM 6.0 - Local File Inclusion author: 0xAkoko severity: high description: FHEM version 6.0 suffers from a local file inclusion vulnerability. impact: | Successful exploitation of this vulnerabilit...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

Apache Flink 1.5.1 - Local File Inclusion

Apache Flink 1.5.1 is vulnerable to local file inclusion because of a REST handler that allows file uploads to an arbitrary location on the local file system through a maliciously modified HTTP HEADER. id: CVE-2020-17518 info: name: Apache Flink 1.5.1 - Local File Inclusion author: pdteam severit...

CVE-2024-4577

CVE-2024-4577 环境构建文件及PHP文件 --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

CoffeeLdr

CoffeeLdr CoffeeLdr es un cargador para los llamados Beacon Object Files. Este proyecto se puede utilizar para probar Beacon Object Files sin usar el framework Cobalt Strike o para dar a los implants personalizados una forma de ejecutar BOFs que fueron diseñados para Cobalt Strike. Pero la mayorí...

Maldoc-Analysis

Maldoc-Analysis 2023年3月，发现了一个新样本被识别为恶意软件。该恶意软件源自扩展名为.xls和.doc的文件，并被称为“Bank Slip.xls”。该恶意软件的活动与已知为CVE-2017-11882和CVE-2018-0802的漏洞有关。...

CVE-2026-12513

CVE-2026-12513: Shared Files 1.7.68 — Eliminación Arbitraria de Archivos No Autenticada mediante Path Traversal 📖 Resumen del Aviso CVE-2026-12513 es una vulnerabilidad de Eliminación Arbitraria de Archivos no autenticada mediante Path Traversal que afecta a los plugins de WordPress Shared Files ...

CVE-2023-33802

CVE-2023-33802 SumatraPDF 3.4.6 -32位拒绝服务（DoS） 描述 在此漏洞中，当我们在SumatraPDF 32位中打开两个大型文本文件（first.txt & second.txt）作为输入时，会出现崩溃。 运行以下命令，或者您可以手动在SumatraPDF 32位3.4.6中同时打开这两个文件。 root@kitploit: SumatraPDF.exe first.txt second.txt 使用WinDBG分析32位版本3.4.6应用程序的崩溃报告 遇到以下崩溃。 root@kitploit: Microsoft R Windows Debugg...

EUVD-2026-77008

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the sndctlasciielemidparse function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-li...