web-inf-path-trav

WebXMLExp.py Tool for helping in the exploitation of path traversal vulnerabilities in Java web applications. This tool is referenced in the Invicti Security white paper Exploiting path traversal vulnerabilities in Java web applications. Install Python3 is required for this tool. Run the followin...

CVE-2021-27328

Path Traversal on Yeastar TG400 GSM Gateway - 91.3.0.3 This is a Proof of Concept for CVE-2021-27328 Example to get firmware decrypting password http://192.168.43.246/cgi/WebCGI?1404=../../../../../../../../../../bin/firmwaredetect to get /etc/paswd...

CVE-2023-26469-Jorani

CVE-2023-26469 Exploitation Tool Overview This is a Proof of Concept PoC exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques. ⚠️ Warning: This tool is intended for security research and authorized testing only...

CVE-2024-34470

CVE-2024-34470 : An Unauthenticated Path Traversal Vulnerability in HSC Mailinspector CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-34470 with Asychronous Performance. Installation git clone https://github.com/th3gokul/CVE-2024-34470.git cd CVE-2024-34470 pip insta...

CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — NLTK Path Traversal Lab A small, reproducible Docker lab that contrasts the percent-encoded path traversal behavior in NLTK 3.9.4 with the corrected behavior in NLTK 3.10.0. The vulnerable version validates the resource name before URL decoding. The fixed payload...

CVE-2026-104826

CVE-2026-104826 - Path traversal to RCE in DropzoneFileExplorer The resumable chunked upload handler trusts the client-supplied fileName all the way to fopen. Feed it ../../ and you write outside your allowed folder, out of the storage root, into the web root. The app serves PHP, so the file you...

CVE-2023-23397

CVE-2023-23397 Outlook Privilege Escalation Proof of Concept for CVE-2023-23397 in Python Quick and easy "proof of concept" in Python for the Outlook CVE that affects Microsoft Office/365 products. Usage 1. Install pywin by running pip install pywin32 2. Start a SMB server on the attacker machine...

CVE-2024-21262

RECORDS Only for reproduction of CVEs. Related Resources: LINK GITHUB1 GITHUB2 ISSUE Check Envs Download docker-24.0.6.tgz from https://download.docker.com/linux/static/stable/x8664/. sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0.6 sudo ln -sf...

CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268

The Post Export Import with Media plugin for WordPress is vulnerable to a Directory Traversal (CWE-22) vulnerability in all versions up to and including 1.17.2 . The flaw exists in the 'theme_slug' parameter, allowing authenticated attackers with administrator-level access or higher to access or ...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : uploaddir = os.path.joinbasedir,...

CVE-2026-111855

A path traversal vulnerability (CWE-22) exists in the web management interface of Tektronix 3 Series MDO devices running firmware versions before 1.21.1 . The root cause is insufficient validation of user-supplied file paths, which allows remote attackers to read arbitrary files accessible to the...

EUVD-2026-103208

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Dependin...

CVE-2026-111854

A path traversal vulnerability exists in the SCPI FILESystem command interface of Tektronix 3 Series MDO devices running firmware versions before 1.21.1 . The root cause is the insufficient validation of file paths supplied to filesystem access commands, which allows remote attackers to read or m...

EUVD-2026-103207

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure

Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplifypath function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted '..%01' sequences. id: CVE-2006-3392 info: name: Webmin 1.290 / Usermin 1.220 -...

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...