EUVD-2026-88131

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...

CVE-2026-82385

Apache Roller version 6.1.5 is vulnerable to an information disclosure flaw where a weblog administrator can read files on the application classpath , including configuration files containing secrets. The root cause is that the Velocity sandbox does not confine include and parse directives, allow...

GhostCat-LFI-exp

GhostCat-LFI-exp CVE-2020-1938 原EXP：https://github.com/YDHCUI/CNVD-2020-10487-Tomcat-Ajp-lfi 只修改了以处，可以本地包含（执行）任意项目下的任意文件。...

CVE-2025-32432-POC

PoC de objetivo único para Craft CMS CVE-2025-32432 Solo pruebas autorizadas. Este repositorio está pensado para entornos de laboratorio controlados, plataformas CTF como Hack The Box, validación interna y verificación defensiva. No lo ejecutes contra sistemas que no te pertenezcan o para los que...

CVE-2026-44642

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

EUVD-2026-87137

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

CVE-2026-44642

Prior to version 16.4.0 , the Piwigo photo gallery application is vulnerable to an authentication bypass due to an SQL injection flaw in the check_upgrade_access_rights() function located in admin/include/functions_upgrade.php. On PHP 8 and later versions, the application fails to properly escape...

Gitmails

Development - IMPORTANT This Gitmails version is no longer maintained. Check out the Gitmails Shell port if you want to use a version that is maintained and, hopefully, developed. If you do not want to use the shell port and prefer the Python version, feel free to fork Gitmails and direct it to...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – PHP Filter Chain Arbitrary File Read Program Code PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper include"php://filter/convert.base64-encode/resource...

CVE-2022-46364-htb-ctf

DevArea SOAP 利用工具 CVE-2022-46364 描述 此专用漏洞利用工具针对 Hack The Box 上的 DevArea 环境。它利用 Apache CXF 3.2.14 中的一个关键漏洞 CVE-2022-46364 来执行 本地文件包含 LFI 和 服务器端请求伪造 SSRF 。 该脚本滥用了 MTOM/XOP （消息传输优化机制）处理引擎。通过注入一个 元素，我们强制服务器的 AttachmentDeserializer 获取本地系统文件或内部网络资源，并将它们反射回 SOAP 响应中。 特性 自动化的多部分构造： 处理触发 XOP 处理所需的复杂...

CVE-2026-62262: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...

EUVD-2026-66211

Trestle SSTI in Jinja2 include tags allows arbitrary code execution Incomplete fix of CVE-2026-46439...

HTB-Pterodactyl-Writeup

Penetration Test Report — HackTheBox: Pterodactyl Date: April 8, 2026 Target: Pterodactyl HackTheBox Difficulty: Medium OS: Linux openSUSE Leap 15.6 Tester: V0idW1re Executive Summary The Pterodactyl machine on HackTheBox presented a realistic attack scenario involving a misconfigured web...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Overview This repository contains a Proof-of-Concept PoC exploit for CVE-2022-46364 , a Local File Inclusion LFI vulnerability in Apache CXF. The vulnerability arises due to improper handling of XOP XML-binary Optimized Packaging Include elements in SOAP...

The vulnerability of the get_page_template() function in the WordPress content management system allows a hacker to execute arbitrary code.

The vulnerability of the getpagetemplate function in the WordPress content management system is related to improper handling of file names for PHP functions like include or require. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

WPSniper

WPSniper CVE-2026-87902 detector for WordPress Core. getpagetemplate can be steered so page-template resolution includes a readable local .php file outside the active theme. WPSniper fingerprints the site, picks a published pageid, probes the include class, and only prints VULN when a strong PEAR...

Astra Linux – Vulnerability in librsvg

A directory traversal vulnerability exists in the URL decoder of librsvg before version 2.56.3. This vulnerability could be exploited by local or remote attackers to access files located in the local filesystem, outside of the expected area. This was demonstrated with the URL...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ICMP: Prevent possible NULL dereferencing from icmpbuildprobe. The first issue involves a double call to indevgetrcu; since the second call might return NULL. if indevgetrcudev && indevgetrcudev-ifalist The second issue involv...

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

ImpactA Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code

SummaryPraisonAI's workflow include implementation implicitly imports and executes an included recipe's tools.py file even when the documented tools.py autoload opt-in is unset.This bypasses the hardening added for the prior automatic tools.py RCE advisory family. A workflow that includes an...