CVE-2023-33902_single_file

Questo repository non contiene un README...

tinyfilemanager-wh1z-edition

Tiny File Manager WH1Z-Edition Introduzione a Tiny File Manager WH1Z-Edition, la soluzione compatta ed efficiente per gestire file e cartelle con funzionalità avanzate di privacy e sicurezza. Addio ai tempi in cui si dipendeva da risorse esterne – ho ridotto il codice all'essenziale, rendendolo...

HTMLawed

HTMLawed è ... ... uno script PHP monofile di 45 kb che rende il testo in input più sicuro, conforme agli standard HTML e, in generale, adatto dal punto di vista di un amministratore di pagine web, per l'uso nel corpo di documenti HTML, XHTML o XML. Una semplice alternativa a HTMLTidy, il filtro,...

CVE-2023-4357-Chrome-XXE

Introduzione allo strumento Il primo EXP a file singolo al mondo che sfrutta la vulnerabilità CVE-2023-4357 Chrome XXE, consentendo di rubare i file locali dei visitatori. Il primo EXP a file singolo al mondo che sfrutta la vulnerabilità CVE-2023-4357 Chrome XXE, consentendo agli attaccanti di...

b374k

b374k shell 3.2 Este PHP Shell é uma ferramenta útil para administradores de sistema ou web realizarem gerenciamento remoto sem usar cpanel, conectando-se via ssh, ftp etc. Todas as ações ocorrem dentro de um navegador web. Recursos : Gerenciador de arquivos visualizar, editar, renomear, excluir,...

fapro

FaPro Kostenlos, plattformübergreifend, massiver Netzwerkprotokoll-Server-Simulator als einzelne Datei 中文Readme Beschreibung FaPro ist ein Tool für Fake-Protokollserver, mit dem mehrere Netzwerkdienste einfach gestartet oder gestoppt werden können. Das Ziel ist es, so viele Protokolle wie möglich...

pcc

PHP Secure Configuration Checker Überprüft die aktuelle PHP-Konfiguration auf potenzielle Sicherheitslücken. Einfach diese Datei von Ihrem Webserver aus aufrufen oder über die CLI ausführen. Autor Diese Software wurde von Ben Fuhrmannek, SektionEins GmbH, entwickelt, um php.ini-Prüfungen zu...

httpstat

httpstat httpstat visualizza le statistiche di curl1 in modo bello e chiaro. È uno script Python a file unico🌟 che non ha dipendenze👏 ed è compatibile con Python 3🍻. Caratteristiche Bell'output nel terminale — suddivisione dei tempi di DNS, TCP, TLS, elaborazione del server e trasferimento del...

CVE-2015-3306

CVE-2015-3306 Este contém um exploit de arquivo único para a vulnerabilidade ProFTPd 1.3.5 modcopy CVE-2015-3306, especialmente para o TryHackMe Kenobi Lab. Descrição da Vulnerabilidade CVE-2015-3306 é uma vulnerabilidade encontrada no ProFTPd 1.3.5 devido a uma falha no módulo modcopy , que é...

CVE-2025-1974-go

Sfrutta CVE-2025-1974 con un singolo file. Uso: root@kitploit: 1. change serverip and serverport in shell.c 2. make 3. GOOS=linux go build -ldflags="-w -s -extldflags "-static"" -trimpath main.go 4. run main in your controlled pod...

shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

CVE-2026-55499

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

GHSA-W8X7-H2PX-XMQ8 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...

GHSA-49H3-CWHJ-4737 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

PT-2026-64431

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrit...

PT-2026-64434

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An authenticated recipient of a single-file share can access file-activity metadata for other files and folders located in the owner's parent folder that were not intended to be shared. This occur...