spb

spb Shortest Path Bridging vulnerability testing scripts used to find CVE-2016-2783...

CVE-2026-75855

Title Path Traversal in "create database" / "drop database" server commands allows arbitrary file write and delete outside the configured database directory Summary The POST /api/v1/server endpoint's create database and drop database commands use the caller-supplied database name to build a...

ApacheStruts-CVE-2018-11776

Apache Struts CVE-2018-11776 Python PoC This is based on https://github.com/hook-s3c/CVE-2018-11776-Python-PoC. The container build and instructions did not work as described in the README so this fork was created. The POC exploit used is from Rapid7. Shoutout: hook-s3c github.com/hook-s3c,...

ImproHound

ImproHound Identify the attack paths in BloodHound breaking your AD tiering ImproHound is a dotnet standalone win x64 exe with GUI. To use ImproHound, you must run SharpHound to collect the necessary data from the AD. You will then upload the data to your BloodHound installation. ImproHound will...

Grafana-CVE-2021-43798Exp

Grafana V8. Arbitrary File Read Exp -- Multi-threaded Batch Verification Script Vulnerability Description Grafana is an open-source metrics analysis and visualization suite. It is often used as a visualization tool for time series data and application analysis of infrastructure, and is also widel...

CVE-2016-5639

CVE-2016-5639 Crestron AirMedia AM-100 Traversal and Hashdump Metasploit Modules Two similar modules that take advantage of CVE-2016-5639 to dump hashes and retrieve files through path traversal. I made these modules separate because I wanted experience writing something that could "dump" hashes,...

CVE-2021-41773

CVE-2021-41773 This is my first time trying to make an exploit for something so...be nice 😁 Exploit Title: Apache HTTP Server 2.4.49 Path Traversal Author: 0xRar , 0xrar.net CVE: CVE-2021-41773 Version: Apache 2.4.49 Not Tested Yet Help Command: python3 exploit.py -h...

CVE-2026-102663 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath...

CVE-2026-102663

Prior to version 4.2.4 , OpenList is vulnerable to unauthorized disclosure of file metadata and existence information due to a non-separator-aware path check in the search API. When Bleve search is enabled, an authenticated user with restricted access can exploit a flawed strings.HasPrefix compar...

Cisco-ASA-FTD-Web-Services-Traversal

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Path Traversal Vulnerability CVE-2020-3452 Usage: CVE-2020-3452.py https://target Vulnerability description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Softwar...

CVE-2023-20198

CVE-2023-20198 Exploit PoC for CVE-2023-20198 Description CVE-2023-20198 is characterized by improper path validation to bypass Nginx filtering to reach the webuiwsmahttp web endpoint without requiring authentication. By bypassing authentication to the endpoint, an attacker can execute arbitrary...

Updated antlr4-project package fixes a security vulnerability

ANTLR4 tokenVocab Grammar Option TokenVocabParser.java getImportedVocabFile path traversal. CVE-2026-13503...

CVE-2015-57115

CVE-2015-57115 Mass Checker For CVE-2015-57115 Description The CVE-2015-57115 Checker Script is a Python tool for detecting vulnerabilities related to CVE-2015-57115, which is a path traversal vulnerability in certain PHP applications. The script checks multiple URLs for the presence of this...

wp2shell

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Batch Route Confusion, CVSS 7.5 + CVE-2026-60137 SQL Injection, CVSS 9.1 A pre-authentication remote code execution chain in WordPress Core that requires no plugins, no special configuration, and works on default installs. Affected Versions...

CVE-2025-4517-POC

CVE-2025-4517 Exploit NOTES This exploit and description are written by AI. If you find a mistake or issue, please let me know! This exploit was tested and confirmed working. Thank you! Overview This exploit leverages CVE-2025-4517 , a critical vulnerability in Python's tarfile module that allows...

BiblioRCE

An oversight within BiblioCraft which allows restricted server-side file manipulation. This method only requires BiblioCraft! Not too much trickery and no other mods are required to achieve code execution! CoreTweaks The original writeup focused on CoreTweaks can be found here. I recommend you re...

CVE-Arsenal-Lab

TomcatScanner Advanced Detection and Exploitation Tool for CVE-2025-24813 TomcatScanner is a comprehensive security tool designed for detecting and exploiting the CVE-2025-24813 vulnerability in Apache Tomcat servers. This vulnerability involves a path equivalence issue in the 'file.Name' paramet...

CVE-2026-59976

The self-hosted file conversion service ConvertX is vulnerable to a path traversal vulnerability in versions prior to 0.18.0 . The ImageMagick converter fails to sanitize the convert_to parameter used to construct output paths. By uploading an extensionless image and providing directory traversal...

CVE-2026-59976 ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2023-27326

Parallels Desktop VM Escape This repository contains an exploit for a Parallels Desktop vulnerability which has been assigned CVE-2023-27326. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. The exploit was tested on Parallels Deskto...