CVE-2026-108158

The plugNmeet Server through 2.5.2 version is vulnerable to a path traversal vulnerability in the /api/whiteboard/convert endpoint. An authenticated meeting participant can provide crafted filePath values containing ../ sequences to force the server to convert arbitrary files into page images. Th...

EUVD-2026-95904

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc1282514...

CVE-2026-104081

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

Security Bulletin: IBM® Db2® could allow a DBADM authenticated user to send a specially crafted request to write arbitrary files on the system (CVE-2026-86087)

Summary IBM® Db2® could allow a database administration authority DBADM authenticated user to send a specially crafted request to write arbitrary files on the system CVE-2026-86087 Vulnerability Details CVEID:CVE-2026-86087 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 cou...

CVE-2026-104081 KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

CVE-2026-104081

KodExplorer versions prior to 4.55 are vulnerable to a path traversal vulnerability located in the unzip_pre_name() function within app/function/helper.function.php. The root cause is a non-recursive str_replace() sanitization pass that can be bypassed using crafted filenames like ....//, combine...

EUVD-2026-95797

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

CVE-2026-103663

A flaw was found in Ollama. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution by exploiting a path traversal flaw in the model pull application programming interface API endpoint. By supplying a crafted layer identifier, an attacker can write malicio...

CVE-2026-103412

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

POC-CVE-2021-42013-EXPLOIT

-ff0055?style=for-the-badge&logo=python 🔥 إطار عمل استغلال CVE-2021-42013 من Makaveli 💀 وضع الهاكر الكوني متعدد الأبعاد نشط... أداة متقدمة للمسح والاستغلال والتفاعل عن بُعد مصممة لاكتشاف واستغلال الثغرة Apache Path Traversal + RCE CVE-2021-42013 في الخوادم غير المهيأة بشكل صحيح. ⚠️ تحذير قانوني يت...

CTF_WRITEUPS-TryHackMe-CVE-2021-41773-

CTFWRITEUPS-TryHackMe-CVE-2021-41773- CTFWRITEUPS/TryHackMe /CVE-2021-41773/ CVE-2021-41773/42013 Une petite explication d'un bug de traversée de chemin dans Apache et d'un correctif incomplet Tâche 1 : Un peu de contexte... Un bref historique Le 5 octobre 2021, un CVE détaillant une attaque par...

day04-nexus-4956

Jour 4 – Traversée de chemin Nexus Repository 3 CVE-2024-4956 Quoi : La traversée de chemin non authentifiée permet à n’importe qui de télécharger des fichiers arbitraires avec une URL spécialement conçue. Vuln : Affecte les versions ≤ 3.68.0 de Nexus Repo 3. Corrigé dans la 3.68.1. Source : Avis...

cve-2021-42013-httpd

Dockerisation d'une Vulnérabilité : cve-2021-42013 Ce projet vise à dockeriser une vulnérabilité spécifique en utilisant Docker. L'objectif est de créer un environnement isolé dans lequel la vulnérabilité peut être exploitée et testée de manière sécurisée. Application vulnérable Apache HTTP Serve...

CVE-2019-5418

CVE-2019-5418 1.وصف الثغرة Ruby on Rails هو إطار عمل لتطبيقات الويب، وهو إطار عمل حديث نسبيًا مبني على لغة Ruby. تحدث هذه الثغرة بشكل أساسي لأن Ruby on Rails يستخدم render file مع معلمات محددة لعرض طرق عرض خارج التطبيق. يمكننا تعديل حزمة الطلب للوصول إلى متحكم معين، واستخدام '../../../../' لتحقيق...

CVE-2020-3153

CVE-2020-3153 Code POC pour CVE-2020-3153 - vulnérabilité de traversée de chemin dans Cisco AnyConnect En savoir plus sur la vulnérabilité ici : https://ssd-disclosure.com/ssd-advisory-cisco-anyconnect-privilege-elevation-through-path-traversal/ Étapes à suivre pour obtenir un shell Windows sur l...

CVE-2026-103412

Apache Camel Karavan versions from 3.18.0 before 4.22.1 are vulnerable to a path traversal vulnerability. The application's project file API uses project file names verbatim as path segments when writing to a working copy for a Git commit. By providing a name containing ../ sequences, an authenti...

CVE-2026-103412 Apache Camel Karavan: project file name path traversal when committing a project to Git

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

EUVD-2026-95756

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

CVE-2019-14322

CVE-2019-14322 Modification de l'exploit de faisalfs10x : Preuve de concept de CVE-2019-14322 : Limitation incorrecte d'un nom de chemin vers un répertoire restreint 'Path Traversal' https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/...