CVE-2024-50629_50631

CVE-2024-5062950631 Pre-auth RCE N-day exploitation of Synology BeeStation. विस्तार: https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron https://github.com/user-attachments/assets/8e2ef59c-4f60-4308-8cd4-6d7ce0ba72e1 root@kitploit: $ python3 poc.py 192.168.88.248 192.168.88.254...

CVE-2017-9554-Exploit-Tool

CVE-2017-9554-Exploit-Tool CVE-2017-9554 शोषण उपकरण Synology DiskStation Manager DSM 6.1.3-15152 - 'forgetpasswd.cgi' उपयोगकर्ता गणना शोषण उपकरण शोषण लेखक : Steve Kaun शोषण उपकरण लेखक : Ez0-yf विक्रेता होमपेज : https://www.synology.com संस्करण : 6.1.3-15152 से पहले CVE : CVE-2017-9554...

Synology-DiskStation-User-Enumeration-CVE-2017-9554-

Enumeração de Usuários do Synology DiskStation CVE-2017-9554 Script básico para enumerar usuários válidos no Synology DiskStation v6.1.3-15152...

CVE-2013-6987

CVE-2013-6987 Múltiplas vulnerabilidades de directory traversal nos componentes FileBrowser do Synology DiskStation Manager DSM anteriores à versão 4.3-3810 Update 3 permitem que atacantes remotos leiam, escrevam e excluam arquivos arbitrários por meio de um .. ponto ponto Uso: root@kitploit:...

CVE-2025-4679-SecureOAuth-Demo---Enfoque-educativo

🔐 Laboratorio di Sicurezza OAuth: Simulatore Didattico CVE-2025-4679 Un ambiente sicuro e isolato per imparare le vulnerabilità OAuth senza rischiare sistemi reali 🚀 Avvio Rapido | 📚 Percorso di Apprendimento | 🛡️ Ambiente Sicuro | 👥 Collaboratori 📖 Panoramica Questo laboratorio didattico simula l...

synodecrypt

SynoDecrypt Uno strumento per decrittare tutti gli archivi crittografati Synology SPK, PAT, .... Il lavoro di reverse engineering è spiegato nel nostro post sul blog. Installazione root@kitploit: pip install -r requirements.txt Utilizzo Per prima cosa devi estrarre le chiavi di crittografia e...

PT-2026-76674

Just a quick note that I saw a new SABB Active Backup spk posted this morning. Version is 3.2.1-25059 dated 12-Aug-2026. This is one of my most important packages so I'll be checking it out. Changelog Fixed a security vulnerability CVE-2026-15716 Fixed an issue where backing up or restoring Hyper...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

EUVD-2026-52187

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

CVE-2026-4793

CVE-2026-4793 affects Synology Assistant prior to 7.0.7-50095. The issue is an incorrect default permissions vulnerability that lets local users read or write arbitrary files and can cause a denial-of-service during installation. Affected component: Synology Assistant (client-side utility) with l...

Synology Man-In-The-Middle

Synology stale DNS allows practical interception of traffic from vulnerable DSM clients, making older vulnerabilities more practical to exploit...

PT-2026-53688

Name of the Vulnerable Software and Affected Versions Synology MailPlus Server versions prior to 4.0.1-31663 Description A critical flaw allows remote attackers to read and write arbitrary files and access internal services, which likely leads to remote code execution RCE, a state where an attack...

CVE-2023-52951

A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential...

CVE-2023-52945

Uncontrolled search path element vulnerability in OpenSSL DLL component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to execute arbitrary code via unspecified vectors...

CVE-2021-47961

A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combin...

CVE-2025-10466

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct...

CVE-2025-12686

Buffer copy without checking size of input 'Classic Buffer Overflow' vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2025-14713

An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server...

CVE-2025-13167

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors...