CVE-2025-64446

POC - CVE-2025-64446 - FortiWeb RCE via Path Traversal + Auth Bypass Overview Fortinet products are some of the most battle-tested appliances protecting enterprise networks today — and ironically, the moment a Forti appliance becomes vulnerable, the blast radius is catastrophic. In late 2025, one...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: A re-implementation of https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py Uses uuids as part of the requested filename to avoid remote server crashing after first path traversal exploitation. run.py / shell.py: wrapper on top of podman to run...

CVE-2022-35899

CVE-2022-35899 Unquoted Service Path Asus GameSdk Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path Privilege Escalation Date: 07/14/2022 Exploit Author: Angelo Pio Amirante Version: 1.0.0.4 Tested on: Windows 10 Patched version: 1.0.5.0 Step to discover the unquoted...

CVE-2024-53677

CVE-2024-53677 - Apache Struts 2 Root Cause Analysis Lab Environment This repository provides a Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2. This vulnerability involves path traversal through the file upload functionality in Struts 2. Source This lab...

path-auditor

PathAuditor The PathAuditor is a tool meant to find file access related vulnerabilities by auditing libc functions. The idea is roughly as follows: Audit every call to filesystem related libc functions performed by the binary. Check if the path used in the syscall is user-writable. In this case a...

CVE-2026-65320-fastcore

CVE-2026-65320: Path Traversal Tar Slip in fastcore via untardir Severity: Critical, CVSS 3.1 9.8 Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected: fastcore = 2.2.30 Fixed in: Not fixed at time of writing CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory,...

CVE-2025-61686_docker

CVE-2025-61686docker Start 1. Build docker-compose up --build 2. Start docker-compose up Reproduction Steps 1. Construct a session that meets the path traversal condition └─$ echo -en '"AAAA../../../tmp/flower"'|base64 -w0 | tr '+/' '-' | tr -d '=' IkFBQUEuLi8uLi8uLi90bXAvZmxvd2VyIg 2. Put the...

CVE-2026-37069

CVE-2026-37069 Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

CVE-2024-46987

CVE-2024-46987: Automated Path Traversal 📖 Overview This repository contains a Python-based Proof of Concept PoC for CVE-2024-46987. This vulnerability is a Path Traversal flaw found in file download modules of certain CMS environments notably Camaleon CMS Version 2.9.0 The script automates the...

CVE-2024-48990

CVE-2024-48990 hello this is 0x3bs In victim machine: set -e cd /tmp 1. Create the malicious module directory structure mkdir -p malicious/importlib in attacker machine to compile lib.c in attacker machine : gcc -shared -fPIC -o exp.so lib.c and in vivtim machine : in /tmp chmod +x run.sh in...

CVE-2021-42013

CVE-2021-42013 Contributor 석은호@eunho87 CVE-2021-42013 Apache HTTP Server Path Traversal Vulnerability Summary A bug in the path normalization handling of Apache HTTP Server 2.4.50 allows arbitrary file reading or remote code execution without authentication. This occurs due to an incomplete patch...

CVE-2021-21402

CVE-2021-21402 CVE-2021-21402 Jellyfin arbitrary file read Wker script, batchable. The logic is very simple, it checks for the existence of win.ini via GET: define payload = /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ define info = CVE-2021-21402 Jellyfin任意文件读取 functi...

CVE-2018-6574

CVE-2018-6574...

CVE-2024-36991-Tool

CVE-2024-36991-Tool This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive files and saves them locally for further analysis. The script is modular, allowing users to target specific file categories e.g...

CVE-2019-19781-CitrixRCE

Citrix Unauthorized Remote Code Execution Attacker - CVE-2019-19781 References: https://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/ Bypassing: 1 - Deleted / Modified scripts at: /vpn/../vpns/portal/scripts/ 2 - Forward Slash "/" issues after perl commnad...

CVE-2026-20262-Cisco-Catalyst-SD-WAN-Manager-Arbitrary-File-Write-

CVE-2026-20262 - Cisco Catalyst SD-WAN Manager Arbitrary File Write Path Traversal -orange 📋 Description CVE-2026-20262 is a Path Traversal CWE-22 vulnerability in the web interface of Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage. It allows an authenticated attacker with write permission...

CVE-2020-3153

CVE-2020-3153 Cisco AnyConnect Secure Mobility Client EoP PoC Thanks to Yorick Koster for publishing details. This is a proof of concept for a path traversal vulnerability in Cisco AnyConnect Secure Mobility Client. Tested with Windows 7 and Windows 10 and AnyConnect version 4.5.x and 4.6.x. For...

OutlookNTLM_CVE-2023-23397

To exploit this vulnerability, an attacker must create a malicious calendar invitation that includes a reference to a sound file pointing to a file in a network share in the attacker's machine. At a low level, an Outlook email stores the reference to the sound file in an internal parameter called...

CVE-2024-36991

CVE-2024-36991 Nuclei Template Description This repository contains a Nuclei template to detect the path traversal vulnerability in Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10. The vulnerability allows unauthorized access to sensitive files, such as /etc/passwd. CVE Detai...

CVE-2025-24071

CVE-2025-24071: Microsoft Windows File Explorer Spoofing Vulnerability script by SilentExploit 📖 Description This project detects and demonstrates exploitation of a Windows File Explorer spoofing vulnerability. The issue arises from a Windows library file .library-ms containing a network path,...