CVE-2024-46987

CVE-2024-46987: स्वचालित पाथ ट्रैवर्सल 📖 अवलोकन इस रिपॉज़िटरी में CVE-2024-46987 के लिए Python-आधारित प्रूफ ऑफ कॉन्सेप्ट PoC मौजूद है। यह भेद्यता एक पाथ ट्रैवर्सल दोष है जो कुछ CMS वातावरणों विशेष रूप से Camaleon CMS संस्करण 2.9.0 के फ़ाइल डाउनलोड मॉड्यूल में पाई जाती है। यह स्क्रिप्ट मानक पाथ...

CVE-2024-48990

CVE-2024-48990 नमस्ते, यह 0x3bs है पीड़ित मशीन में: set -e cd /tmp 1. Create the malicious module directory structure mkdir -p malicious/importlib हमलावर मशीन में lib.c को कंपाइल करने के लिए: gcc -shared -fPIC -o exp.so lib.c और पीड़ित मशीन में : /tmp में chmod +x run.sh /tmp/malicious/importlib...

CVE-2021-42013

CVE-2021-42013 Contribuidor 석은호@eunho87 CVE-2021-42013 Apache http Server Path Traversal Resumo da Vulnerabilidade É um bug no processamento de normalização de caminho do Apache HTTP Server 2.4.50 que permite ler arquivos arbitrários ou executar código remoto sem autenticação. Ocorreu devido a um...

BlueHound

BlueHound é uma ferramenta de código aberto que ajuda as equipes azuis a identificar os problemas de segurança que realmente importam. Ao combinar informações sobre permissões de usuários, acesso à rede e vulnerabilidades não corrigidas, o BlueHound revela os caminhos que os atacantes seguiriam s...

dotdotslash

dotdotslash Uma ferramenta para ajudá-lo a pesquisar por Vulnerabilidades de Travessia de Diretório Benchmarks Plataformas que testei para validar a eficiência da ferramenta: DVWA low/medium/high bWAPP low/medium/high Screenshots Instalação Você pode baixar a última versão clonando este repositór...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

CVE-2021-21402

CVE-2021-21402 CVE-2021-21402 Jellyfin leitura arbitrária de arquivos Script Wker, pode ser executado em lote. A lógica é muito simples, é verificar a existência do win.ini através de GET: define payload = /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ define info =...

CVE-2018-6574

CVE-2018-6574...

CVE-2024-36991-Tool

CVE-2024-36991-Ferramenta Este PoC binário automatiza a exploração do CVE-2024-36991 enviando requisições curl elaboradas para uma instância Splunk vulnerável. Ele recupera arquivos sensíveis e os salva localmente para análise posterior. O script é modular, permitindo que os usuários segmentem...

Fast-Google-Dorks-Scan

Varredura Rápida de Google Dorks O projeto OSINT, cuja ideia principal é coletar todas as combinações possíveis de Google dorks e encontrar informações sobre o site específico: painéis de administração comuns, tipos de arquivos difundidos e path traversal. 100% automatizado. Exemplo de uso: chmod...

CVE-2019-19781-CitrixRCE

Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781 References: https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ बायपास करना: 1 - /vpn/../vpns/portal/scripts/ पर हटाई गई/संशोधित स्क्रिप्ट्स 2 - perl commnad injection टेम्पलेट इंजेक्शन हमले क...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager Escrita Arbitrária de Arquivos Path Traversal -orange 📋 Descrição CVE-2026-20262 é uma vulnerabilidade de Path Traversal CWE-22 na interface web do Cisco Catalyst SD-WAN Manager anteriormente SD-WAN vManage. Permite que um atacante autenticado com...

CVE-2020-3153

CVE-2020-3153 إثبات المفهوم لرفع الامتيازات في Cisco AnyConnect Secure Mobility Client شكرًا لـ Yorick Koster على نشر التفاصيل. هذا إثبات مفهوم لثغرة اجتياز المسار في Cisco AnyConnect Secure Mobility Client. تم الاختبار على Windows 7 وWindows 10 مع إصدارات AnyConnect 4.5.x و4.6.x. بالنسبة للإصدار...

CVE-2026-108693

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with...

Korenix JetPort 5601v3 - Path Traversal

The pathname of the root directory to a Restricted Directory 'Path Traversal' vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601- through 1.2. id: CVE-2024-11303 info: name: Korenix JetPort 5601v3 - Path Traversal author: geeknik severity: high description...

Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

WordPress OrderConvo < 14 - Path Traversal

WooCommerce OrderConvo WordPress plugin \u003C 14 contains a path traversal vulnerability caused by improper validation of file download paths, letting unauthenticated attackers read or download arbitrary files remotely id: CVE-2025-10162 info: name: WordPress OrderConvo 14 - Path Traversal autho...

DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal

DataEase versions up to and including 2.10.3 contain an authentication bypass in io.dataease.auth.filter.TokenFilter. The filter passes the raw, unnormalized request URI to WhitelistUtils.match, which only checks for whitelisted prefixes such as /geo/, /customGeo/, /map/, /oauth2/, and /websocket...

OpenFlagr <= 1.1.18 - Authentication Bypass

OpenFlagr = 1.1.18 contains an authentication bypass caused by improper path normalization handling in HTTP middleware whitelist logic, letting attackers access protected API endpoints without valid credentials, exploit requires crafted requests. id: CVE-2026-0650 info: name: OpenFlagr = 1.1.18 -...

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...