splitting-the-email-atom

拆分电子邮件原子：利用解析器绕过访问控制 欢迎来到本仓库。本仓库包含了我演讲“拆分电子邮件原子：利用解析器绕过访问控制”的所有材料。 你可以通过以下地址阅读这项研究： https://portswigger.net/research/splitting-the-email-atom Joomla 目录包含了我于 Black Hat 和 DEFCON 现场演示的所有复现代码。 tools 目录包含了我用于这项研究的所有工具。包括 CSS 数据窃取器、Hackvertor 标签、PHP Punycode 模糊测试器、转换器、SMTP 模糊测试脚本以及 Turbo Intruder 脚本。 学...

Python Library aiohttp < 3.14.1 Multiple Vulnerabilities

The version of the aiohttp Python library installed on the remote host is prior to 3.14.1. It is, therefore, affected by multiple vulnerabilities: - Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to...

Linux Distros Unpatched Vulnerability : CVE-2026-32766

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.6 and earlier, malformed PAX extensions were silently skipped when...

EUVD-2021-24893

Malware in sbrugna...

EUVD-2019-6813

Malware in sbrugna...

EUVD-2025-10913

Malicious code in bioql PyPI...

EUVD-2022-3072

Malicious code in bioql PyPI...

CVE-2025-8586

A vulnerability, which was classified as problematic, was found in libav up to 12.3. This affects the function ffseekframebinary of the file /libavformat/utils.c of the component MPEG File Parser. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local...

CVE-2025-8586

CVE-2025-8586 affects libav up to 12.3, in the MPEG File Parser component ff_seek_frame_binary (file libavformat/utils.c). The upstream description states a null pointer dereference can be triggered, with a local attack vector. Public exploit information is cited, and the vulnerability impacts pr...

CVE-2020-14509

Multiple memory corruption vulnerabilities exist in CodeMeter All versions prior to 7.10 where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities...

Ackites KillWxapkg vulnerable to OS Command Injection

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated...

CVE-2025-3585 westboy CicadasCMS JSP Parser upload unrestricted upload

A vulnerability classified as critical has been found in westboy CicadasCMS 1.0. This affects an unknown part of the file /upload/ of the component JSP Parser. The manipulation of the argument File leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...

ROS-20240816-13

Vulnerability in the ASN1 Parser function GTime2str of the libcurl library is related to reading outside of memory boundaries memory. Exploitation of the vulnerability could allow an attacker acting remotely to cause an octasis in the maintenance...

PT-2022-12079 · Reolink · Reolink Rlc-410W

Name of the Vulnerable Software and Affected Versions: reolink RLC-410W version 3.0.0.136 20121102 Description: A denial of service issue exists in the cgiserver.cgi JSON command parser functionality. This can be triggered by a specially-crafted HTTP request, leading to a reboot. The SetIrLights...