mime-is-broken

用于生成和测试畸形 MIME 的工具包 这是一个工具包，用于生成带有损坏 MIME 的邮件，以测试 MUA 和安全产品的行为，即它们是否一致，或者损坏的 MIME 是否可用于绕过安全产品。 文件 tools/ 用于创建损坏邮件和进行测试的工具。参见其中的 README.md 预生成的邮件位于 hide-content.d 和 hide-filename.d hide-content.d/ 包含用于隐藏内容 eicar.zip 的生成邮件的 Maildir hide-filename.d/ 包含用于隐藏真实文件名 file.zip 的生成邮件的 Maildir libtests/...

PoC-CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP 上传 RCE 自动利用 Krayin CRM ≤ 2.2.x 的漏洞。此脚本利用 TinyMCE 端点（/admin/tinymce/upload）中的无限制文件上传漏洞，通过伪造 image/jpeg 绕过 MIME 类型验证，上传 PHP webshell，并以 Web 服务器权限执行任意命令。 漏洞详情 属性| 值 ---|--- CVE ID| CVE-2026-38526 受影响软件| Krayin CRM ≤ 2.2.x 漏洞类型| 无限制文件上传 → 远程代码执行 认证| 必需（任意有效管理员账户） 端点|...

CVE-2023-38836

CVE-2023-38836 漏洞利用工具 BoidCMS v2.0.0 中存在文件上传漏洞，允许已认证的攻击者上传危险类型文件 CWE-434。 要利用此漏洞，攻击者可以添加 GIF 文件头以绕过 MIME 类型检查。 GIF89a; 使用方法 usage: CVE-2023-38836.py -h -u URL -U USER -P PASSWD -l LHOST -p LPORT CVE-2023-38836 漏洞利用工具 options: -h, --help 显示此帮助信息并退出 -u URL, --url URL 网站 URL -U USER, --user USER...

CVE-2026-42879

CVE-2026-42879 - FacturaScripts - 通过 MIME 类型绕过实现已认证的不受限制文件上传 摘要 FacturaScripts 的产品图片上传功能中存在一个已认证的不受限制文件上传漏洞。拥有有效凭据的攻击者可以上传伪装成 GIF 图片（使用 GIF89a 文件头）的 PHP 文件，从而绕过 MIME 类型验证。该文件会以其原始扩展名存储，包括 .php 等可执行扩展名。 详细信息 该漏洞存在于： Core/Lib/ExtendedController/ProductImagesTrait.php 具体位于 addImageAction 方法中。 漏洞代码 i...

EUVD-2026-68800

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload RCE...

CVE-2026-81891

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

PT-2026-84022

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description The checkExtractItems function in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Due to the absence of .phtml, .phar, .php5, a...

CVE-2026-68899

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

CVE-2026-68899

Prior to Wekan 9.90, detectMimeFromFile() in models/fileValidation.js returned undefined when the Unix file binary was absent, causing validation to fall back to attacker-controlled fileObj.type via server/routes/attachmentApi.js. On deployments with WITH_API=true and no file binary, an authentic...

CVE-2026-15748

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

Exploit for CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypas...

CVE-2026-61448 Parse Server 9.0.0 Stored XSS via malformed Content-Type

Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...

Drupal 10.5.x < 10.5.12 / 10.6.x < 10.6.11 / 11.2.x < 11.2.14 / 11.3.x < 11.3.12 Multiple Vulnerabilities (drupal-2026-06-17)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.5.x prior to 10.5.12, 10.6.x prior to 10.6.11, 11.2.x prior to 11.2.14, or 11.3.x prior to 11.3.12. It is, therefore, affected by multiple vulnerabilities. - Drupal core contains a chain of metho...

CVE-2026-44587 CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the contenttypedenylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In...

CVE-2026-34429

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. Attackers can prepend a GIF8...

CVE-2026-34429

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. Attackers can prepend a GIF8...

CVE-2026-34429 Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. Attackers can prepend a GIF8...

📄 WordPress AI Engine: ChatGPT Chatbot 1.9.98 Shell Upload

This is a proof of concept that demonstrates the CVE-2023-51409 vulnerability in the WordPress AI Engine plugin in a controlled, safe, and non-destructive manner. It detects the plugin, tests unauthenticated access to the vulnerable endpoint, performs safe file uploads with non-executable content...