CVE-2021-25094

CVE-2021-25094 Tatsu Plugin ZIP File addcustomfont unrestricted upload usage php p.php...

timesketch

Timesketch Table of Contents 1. About Timesketch 2. Getting started 3. Community 4. Contributing About Timesketch Timesketch is an open-source tool for collaborative forensic timeline analysis. Using sketches you and your collaborators can easily organize your timelines and analyze them all at th...

CVE-2025-24071_PoC

CVE-2025-24071 / CVE-2025-24054 PoC Edit: MICROSOFT HAS BEEN RENAMED CVE-2025-24071 AS CVE-2025-24054 🤔 Overview This Windows vulnerability, specifically in 'explorer.exe', allows us to receive a NetNTLMv2 hash from a victim simply by having the attacker extract a .zip file. Usage Execute the...

Wormy

Wormy - The challenge In this repo I will write some functions in python3 in my free time to add "some spreading features like worms" to any python backdoor. After finishing I will make it a real worm ToDo list : 1Spread in drivers, add to startup and continuous check✓ 2Spread in python scripts b...

ZIPFileRaider

ZIP File Raider - Burp Extension for ZIP File Payload Testing ZIP File Raider is a Burp Suite extension for attacking web application with ZIP file upload functionality. You can easily inject Burp Scanner/Repeater payloads in ZIP content of the HTTP requests which is not feasible by default. This...

CVE-2025-24071-POC

sudo apt update sudo apt install wine wine CVE-2025-24071-POC.exe -i 10.10.14.8 -n try ZIP creado: try.zip impacket-smbserver: smbserver.py try /root/smbshare -smb2support -ip 10.10.14.8 -debug Impacket Exegol fork v0.13.0.dev0+20250723.125503.b5db2dd7 - Copyright Fortra, LLC and its affiliated...

CVE-2023-50564-pluck

CVE-2023-50564-pluck CVE-2023-50564 An arbitrary file upload vulnerability in the component /inc/modulesinstall.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file. This is an authenticated vulnerability. Disclaimer: This code is meant for...

CVE-2023-36025

CVE-2023-36025 Simple test for CVE-2023-36025, based on PoC demoed in https://twitter.com/wdormann/status/1725148437115473947 This code is not meant to run out of the box - the ZIP file must be hosted on a server you own, and be accesible to the victim machine on a file:// URL...

zip_smuggling

zipsmuggling This Python utility creates zip files that contain additional data embedded within the file structure. This extra data is not visible/does not display when the zip is examined or decompressed, but can be retrieved using powershell via a Windows shortcut file LNK within the zip file...

CVE-2023-40028

CVE-2023-4002 Ghost-Arbitrary-File-Read : The username/email for the target Ghost CMS. --password : The password for the target Ghost CMS. --url : The URL of the target Ghost CMS e.g., http://website.com. 1. Login: The script authenticates with the Ghost CMS admin API and retrieves a session...

Zip-Cracker-

Zip Cracker This Script Supports Only Zip File in This Verson You Can Also Use This Script With crunch Cross-platform Supported Usage: zipcracker.py options Options: --version show program's version number and exit -h, --help show this help message and exit -f FILENAME, --file=FILENAME Please...

CVE-2016-5636

CVE-2016-5636 PoC for CVE-2016-5636, which is a heap overflow in Python 3.6. This repository includes: crash-with-zip : crash PoC by reading untrusted zip file google-web-engine : crash PoC working on google web engine spawn-shell : a local exploit for spawning shell...

zipbrk

zipbrk 2.2.0 Zip break is a tool to disect, modify, and reassemble zip files for a variety of tasks. It is designed to be cross-platform and as simple as possible to port between varied systems. It has been tested on Windows 9x/2k/XP, Windows Vista/7/8, Fedora 23/24/25/26/27, Kali, Debian 8/9,...

zip_bomb

ZIP Bomb Creator ZIP Bomb Creator is a tool used to create a ZIP file that is small in size but drastically expands when extracted. This is useful for security experiments and testing file systems against ZIP Bomb attacks. Features Create a ZIP Bomb with configurable file count and size. Supports...

CVE-2023-50564

CVE-2023-50564 For educational purposes only. This script abuses CVE-2023-50564 to upload a reverse-php shell to the target server. You can use a shell like this one. Just zip the php file and pass the zip to this script. Example python3 cve-2023-50564.py -u http://idonot.exist -f shell.zip -p...

CVE-2023-50564

CVE-2023-50564 CVE-2023-50564 is an RCE vulnerability in Pluck CMS v4.7.18. It is made possible through an arbitrary file upload vulnerability in the /inc/modulesinstall.php component allowing to execute arbitrary code by uploading a malicious .zip file. Usage Before running the exploit, the...

CVE-2026-114102

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

EUVD-2026-106905

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

CVE-2026-114102

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

PT-2026-120228

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...