cve-2025-24071

CVE-2025-24054 and CVE-2025-24071 - NTLM Hash Leak via .library-ms Exploit This PoC demonstrates the exploitation of the NTLM hash leak via .library-ms files on unpatched Windows systems March 2025 Patch Tuesday. ⚠️ This is for educational and research purposes only. Do not use this on production...

CVE-2021-41773-POC

CVE-2021-41773 Informe de Reproducción de Vulnerabilidad Resumen de la Vulnerabilidad CVE ID : CVE-2021-41773 Nombre de la Vulnerabilidad : Vulnerabilidad de Path Traversal en Apache HTTP Server Nivel de Riesgo : Alto CVSS 7.5 Versiones Afectadas : Apache HTTP Server 2.4.49 Descripción de la...

struts-uploader-vulnerability

CVE-2024-53677 — Cómo funciona el exploit y cómo ejecutarlo Resumen de la vulnerabilidad El fallo está en cómo FileUploadInterceptor de Struts entrega el nombre del archivo subido a la clase de acción. Normalmente el interceptor sanitiza el nombre del archivo, pero Struts también permite que...

CVE-2026-85272

CVE-2026-85272 affects Open edX Platform from Aspen.1 through the Ulmo and Verawood.1 releases. The root cause lies in openedx/core/lib/extract_archive.py, where the _is_bad_path function validates extracted archive targets using a string prefix comparison (startswith) instead of comparing indivi...

CVE-2025-49132_HTB_SEASON10

CVE-2025-49132 - Exploit RCE de Pterodactyl Panel HTB Temporada 10 - Writeup de la Máquina Pterodactyl Resumen Objetivo: Máquina Pterodactyl HTB Dificultad Media CVE: CVE-2025-49132 Severidad: Crítica CVSS 9.8 Tipo de Ataque: Ejecución Remota de Código No Autenticada Afectado: Pterodactyl Panel...

CVE-2026-82896

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

CVE-2026-84086 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

EUVD-2026-83440

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

CVE-2026-82896 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

EUVD-2026-83411

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

CVE-2026-82896

IBM Guardium Data Protection 12.2 is affected by a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to traverse directories on the system. The vulnerability carries a CVSS 3.1 score of 7.6 (HIGH) with low confidentiality impact, high integrity impact, and low avai...

EUVD-2017-19014

Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...

CVE-2017-20284

Caucho Resin contains a path traversal vulnerability in its resin-doc documentation webapp. The flaw resides in the jndi-appconfig tutorial servlet , where the inputFile request parameter accepts relative paths with directory traversal sequences, allowing remote unauthenticated attackers to read ...

CVE-2025-10951

CVE-2025-10951 - checkmlloggertraversal.py Proof-of-existence checker for CVE-2025-10951 / GHSA-8x9j-2p8r-7xc6 — an unauthenticated path traversal in geyang/ml-logger ≤ 0.10.36, affecting the loghandler / streamhandler functions in mllogger/server.py. For use only against systems you are authoriz...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download Handler Proof-of-concept for CVE-2026-18907 CVSS 7.5 High, CWE-23, a relative path-traversal vulnerability in the download file feature of TECNO Hi Browser com.talpa.hibrowser version 2.23.1.1. The browser trusted an attacker-controlled...

CVE-2026-93751

uri-js through version 4.4.1 is affected by an improper UTF-8 decoding flaw in the pctDecChars() function. The function incorrectly decodes invalid and overlong percent-encoded sequences into ASCII metacharacters, allowing attackers to craft payloads that bypass platform decoder validation and in...

Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445

Perses , an open-source observability dashboard, is affected by a filesystem path traversal vulnerability (CVSS 4.0: 7.1 HIGH ) in its list endpoints when the file-system database backend is active. The request-controlled project query parameter is bound into the resource Query struct without val...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...