CVE-2026-41545 WebSocket timelapse path traversal and command injection

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...

Malicious code in py-worm (PyPI)

Source: kam193 d4c5838f30da7c1f684305ec0704ef37e963793449390f5b13a4e06212ccbd9d The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in py-sock2 (PyPI)

Source: kam193 317abc5a9c1b535f3db6fd260a2f77eaaceb45745cd93deea7e9b3dd1d0cb933 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

EUVD-2026-101976

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...

CVE-2024-28995

CVE-2024-28995 Disclaimer This tool is only for personal security research and learning. Any direct or indirect consequences and losses caused by the dissemination or use of this tool are the responsibility of the user. The tool author assumes no responsibility. version = 15.4 NAME: Serv-U -...

INPGer

INPGer | CVE-2022-4063 - InPost Gallery Automatic Mass Tool for checking vulnerability in CVE-2022-4063 - InPost Gallery install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use bash inpger.sh yourlist.txt thread Reference...

CVE-2019-13288-POC

CVE-2019-13288-POC xpdf/install/bin/pdftotext ./poc.pdf In Xpdf 4.01.01, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. This is similar to CVE-2018-16646...

CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

apxutil

A tool to manipulate Schneider Electric PLC archive files This tool can extract and reassemble PLC "archive" files, used by several Schneider Electric PLC:s, including at least M580, M340 and Quantum. The archive files with an extension of .sta are really a zip archive containing a few files...

CVE-2026-16437

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 Reflected SVG XSS Reflected Cross-Site Scripting XSS via SVG Rendering in FuguHub https://vulners.com/cve/CVE-2025-65790 This repository documents a Reflected Cross-Site Scripting XSS vulnerability in FuguHub 8.1 , where SVG files containing inline JavaScript are...

CVE-2021-40978

CVE-2021-40978 mkdocs built-in dev-server directory traversal exploitation Mkdocs 1.2.2 allows directory traversal through the built-in dev-server which responds on port 8000. There is below some examples of successfully exploited paths: Impact Using this tecnique it is possible to fetch files...

CVE-2022-1388

CVE-2022-1388 Nuclei Template for CVE-2022-1388. I have used the shadow file for poc , you can use the passwd '/etc/passwd' file as well. Change the Extractor according to your choice. POC Reference: https://support.f5.com/csp/article/K23605346...

CVE-2019-12744

CVE-2019-12744 Information Exploit Title: Remote Command Execution through Unvalidated File Upload in SeedDMS versions 5.1.11 CVE: CVE-2019-12744 Vendor Homepage: https://www.seeddms.org/index.php?id=2 Exploit Author: NobodyAtall Tested version: Seeddms 5.1.10, 5.0.11 Tested OS: Windows 7 x64...

CVE-2006-3392

CVE-2006-3392 https://www.cvedetails.com/cve/CVE-2006-3392/ Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequence...

CVE-2018-0296

Exploit-CVE-2018-0296 Python exploit for the recent Cisco ASA Path Traversal Vulnerability. This exploit will try to return the files from the index. Usage $ git clone https://github.com/bhenner1/CVE-2018-0296.git $ cd CVE-2018-0296 $ python CVE-2018-0296.py $ Vulnerable URL/IP -...

CVE-2025-5394

CVE-2025-5394 – WordPress Alone Theme = 7.8.3 - Unauthenticated Arbitrary File Upload via Plugin Installation 🔥 Vulnerability Summary The WordPress theme Alone versions = 7.8.3 is vulnerable to an unauthenticated arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to...

wso2-rce-cve-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which which allows unauthenticated attackers to gain RCE on WSO2 servers via uploading...

CVE-2022-39197

CVE-2022-39197 RCE POC Reference Links https://mp.weixin.qq.com/s/Eb0pQ-1ebLSKPUFC7zS6dg — There’s a great in depth analysis of this vulnerability https://www.agarri.fr/blog/archives/2012/05/11/svgfilesandjavacodeexecution/index.html...

CVE-2023-26469

CVE-2023-26469 REC PoC This repository contains an exploit script for CVE-2023-26469, which allows an attacker to leverage path traversal to access files and execute code on a server running Jorani 1.0.0. Additionally, the script includes shell upload functionality for further exploitation...