CVE-2026-56718

CVE-2026-56718 Traversal de ruta no autenticado en jdbhttpd/0.1.0 firmware AJCloud AJY IPC que permite la lectura remota de archivos arbitrarios como root, incluidas las credenciales RTSP en texto claro. CWE: CWE-22 Limitación inadecuada de un nombre de ruta a un directorio restringido Severidad:...

CVE-2026-35031

CVE-2026-35031: Vulnerabilidad de Path Traversal en la Subida de Subtítulos de Jellyfin que deriva en RCE -darkred?style=flat-square -orange?style=flat-square TL;DR Una vulnerabilidad crítica de path traversal en Jellyfin Media Server permite a usuarios autenticados con el permiso "Upload...

CVE-2017-15950

CVE-2017-15950 PoC de exploit para la vulnerabilidad CVE-2017-15950 SyncBreeze XML Parser y/o funcionalidad Sync Stack-Based Buffer Overflow. Uso Al ejecutar el generador de payload XML, el script generará un archivo XML xplSyncBreeze.xml que contiene el payload para importar usando SyncBreeze...

CVE-2026-66491

Lectura arbitraria de archivos mediante getSource en PhocaCommander PhocaCommander ≤ 6.1.3 — Path Traversal autenticado de administrador, sin CSRF requerido RESUMEN Existe una vulnerabilidad de lectura arbitraria de archivos en el endpoint del editor de archivos de PhocaCommander. La función...

CVE-2021-41773

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal & RCE ⚠️ For isolated, educational lab use ONLY. This repository builds a deliberately vulnerable Apache server. Never run it on a live, production, or internet-facing host. Red Team internship project by Team Alpha ITSOLERA — Offensive...

CVE-2026-28199 Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential...

CVE-2026-28199 Sensitive File Disclosure via Relative Path Traversal in NetBackup Flex OS Shell

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential...

CVE-2026-28199

CVE-2026-28199 affects NetBackup Flex OS , where an authenticated user with access to the management shell can supply a specially crafted path argument to a diagnostic command, enabling relative path traversal to read arbitrary files from the underlying operating system. Successful exploitation m...

Poc_CVE-2025-68645

CVE-2025-68645 - Vulnerabilidad de Path Traversal en Zimbra 📋 Resumen CVE-2025-68645 es una vulnerabilidad de path traversal en Zimbra Collaboration Suite que permite a atacantes no autenticados leer archivos arbitrarios del sistema de archivos del servidor. Endpoint Vulnerable...

CVE-2026-87743

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2017-9841

🔍 Features Multi-threaded scanning for efficient testing of multiple targets Intelligent payload generation with unique identifiers for accurate validation Multiple vulnerability path checking across common web application structures Automatic response validation to confirm actual vulnerabilities...

CVE-2026-87743

CVE-2026-87743 is an authorization bypass in Quarkus HTTP security (quarkus-vertx-http). The root cause is a path normalization discrepancy between the security matcher and HTTP request dispatchers: an unauthenticated attacker can craft a URL that the security matcher treats as public, but which ...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

CVE-2026-87743 Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

EUVD-2026-82862

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...

apache-cve-2021-42013-lab

Apache HTTP Server 2.4.49 路径遍历与远程代码执行 CVE-2021-42013 关于项目 在本项目中，我使用Docker搭建的实验室环境展示了Apache HTTP Server 2.4.49版本中存在的CVE-2021-42013漏洞。 目的是在可控环境中研究漏洞的产生原理、运行机制及其对系统的影响。 本研究仅供教育和实验室目的使用。 使用的技术 Docker Ubuntu 22.04 Apache HTTP Server 2.4.49 Bash curl 项目文件结构 root@kitploit: . ├── Dockerfile ├── index.htm...

CVE-2026-6205

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

CVE-2026-40536

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40535

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

CVE-2026-40532

A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...