CVE-2024-31835

CVE-2024-31835 Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a craftedpayload to the file name parameter. Affected Component: FlatPress CMS Admin Panel File Upload Field Fixed version: Flatpress v1.3 - will be fixed in...

Nginx-CVE-2013-4547

Nginx Filename Logic Vulnerability CVE-2013-4547 Vulnerability Description Affected versions: Nginx 0.8.41 1.4.3 / 1.5.0 1.5.7 Reference links: https://vulners.com/cve/CVE-2013-4547 https://blog.werner.wiki/file-resolution-vulnerability-nginx/ http://www.91ri.org/9064.html Vulnerability Descripti...

CVE-2025-63408

CVE-2025-63408 path-traversal.py: A re-implementation of https://github.com/eric-m-holub/double-agent/blob/main/doubleagent.py Uses uuids as part of the requested filename to avoid remote server crashing after first path traversal exploitation. run.py / shell.py: wrapper on top of podman to run...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

CVE-2025-58180

CVE-2025-58180 RCE in OctoPrint via Unsanitized Filename in File Upload In OctoPrint version =1.11.2, an attacker with file upload access e.g., valid API key or session can craft a malicious filename that bypasses sanitization and is later executed by OctoPrint’s event system, leading to remote...

CVE-2017-15715-httpd

CVE-2017-15715-httpd WHS 4th Container Assignment Summary Apache HTTPD is a widely used HTTP server that can run PHP web pages through modphp. From versions 2.4.0 to 2.4.29, there is a parsing vulnerability where a file name ending in .php, such as 1.php\x0A, is recognized as a PHP file, allowing...

xerial__sqlite-jdbc_CVE-2023-32697_3-41-2-1

SQLite JDBC Driver SQLite JDBC is a library for accessing and creating SQLite database files in Java. Our SQLiteJDBC library requires no configuration since native libraries for major OSs, including Windows, macOS, Linux etc., are assembled into a single JAR Java Archive file. Usage ➡️ More usage...

CVE-2026-104826

CVE-2026-104826 - Path traversal to RCE in DropzoneFileExplorer The resumable chunked upload handler trusts the client-supplied fileName all the way to fopen. Feed it ../../ and you write outside your allowed folder, out of the storage root, into the web root. The app serves PHP, so the file you...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-35585 , a critical OS Command Injection vulnerability discovered in File Browser versions 2.0.0 through 2.33.1. The vulnerability exists in the "Custom Command Hooks"...

ESAFENET CDG - Arbitrary File Download

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. id: CVE-2019-9632 info: name: ESAFENET CDG - Arbitrary File Download author: pdteam severity: hi...

Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal

Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST AP...

Movies <= 0.6 - Cross-Site Scripting

A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4539 info: name: Movies = 0.6 - Cross-Site Scripting author: daffainfo...

Langflow <= 1.8.4 - Path Traversal to RCE via File Upload

The application contains a path traversal vulnerability caused by unsanitized 'filename' parameter in the 'POST /api/v2/files' multipart form data, letting attackers write files to arbitrary filesystem locations, exploit requires crafted request. id: CVE-2026-5027 info: name: Langflow = 1.8.4 -...

Avid NEXIS Agent - Arbitrary File Read

Avid NEXIS E-series, F-series, PRO+, and System Director Appliance SDA+ before 2025.5.1 contain an unauthenticated arbitrary file read caused by improper validation of the filename parameter, letting unauthenticated attackers read sensitive files, exploit requires no authentication. id:...

CodiMD <2.5.4 - Insecure Filename Randomization

CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...

CVE-2026-25645

CVE-2026-25645 Insecure Temporary File Reuse in requests.utils.extractzippedpaths Executive Summary A vulnerability was identified in the requests library Python within the public utility function requests.utils.extractzippedpaths. The function utilizes a predictable, non-unique filename when...

CVE-2026-92263

The SparkyFitness health and fitness tracker is vulnerable to OS command injection in versions prior to 1.6.0 . The flaw exists in the api/admin/backup/restore endpoint, where the application interpolates an uploaded filename directly into a shell command. An authenticated global administrator ca...

PSTrojanFile

PSTrojanFile Windows PowerShell Filename and Defender Anti-Malware API - Code Execution POC Discovery: John Page aka hyp3rlinx 2019 and revisted 2023 Updated Dec 24, 2023 Bypassing single quotes obstacle in PowerShell for code exec and bonus PS Windows Event log fail! Semicolon and friend "&"...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...