EUVD-2026-84744

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2026-77262

The MCP Atlassian (sooperset/mcp-atlassian) server is vulnerable to a Path Traversal vulnerability in the confluence_upload_attachment tool prior to version 0.22.0 . The root cause is the lack of path validation on the file_path argument, which is passed directly to the open() function. This allo...

CVE-2026-77262 MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment accepts an attacker-controlled filepath and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside...

CVE-2024-6648

CVE-2024-6648 Plantilla de Nuclei para CVE-2024-6648, traversal de ruta absoluta en el plugin ApPage Builder de Prestashop. Uso: nuclei -u https://vulnerable.site.com -t CVE-2024-6648.yaml...

CVE-2019-14530

CVE-2019-14530 Path traversal and DoS vulnerability in OpenEMR project Vulnerable function in file: /openemr/custom/ajaxdownload.php Conditions: 1. any authorized user 2. for DoS case: directory "/sites/default/documents/cqmqrda/" must exists on server Due to logic of "unlink" function, path to...

CVE-2019-14751_PoC

CVE-2019-14751PoC A Proof of Concept for CVE-2019-14751 Vulnerability Description NLTK Downloader before version 3.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ dot dot slash in an NLTK package ZIP archive that is mishandled during extraction. For...

CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

CVE-2026-77271 MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of CVE-2026-27825)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

npm-tar-path-traversal-scanner

CVE-2026-31802 — Escáner de Path Traversal en npm tar Detecta paquetes npm vulnerables a CVE-2026-31802 , una vulnerabilidad de path traversal en el paquete npm tar que permite la escritura arbitraria de archivos durante la extracción de archivos. Características Escanea package-lock.json en busc...

CVE-2007-4559

demostración de CVE-2007-4559 ¿qué es esto? Esta es una demostración de cómo el manejo predeterminado de Python para la extracción de archivos tar anterior a Python v3.11.4 es vulnerable a un simple ataque de symlink. Las instrucciones a continuación describen cómo crear un payload malicioso. El...

CVE-2020-13424

Título del exploit: Joomla! Plugin XCloner Backup 3.5.3 - Inclusión de archivo local Autenticado Fecha: 2020-05-10 Autor del exploit: Mehmet Kelepçe / Gais Cyber Security ID de autor en Exploit-Db: 8763 Referencia:...

CVE-2021-41773

Exploit de Path Traversal y RCE en Apache CVE-2021-41773 & CVE-2021-42013 Estas son vulnerabilidades críticas de path traversal que afectan a Apache HTTP Server 2.4.49 y 2.4.50. Permiten a los atacantes: Acceder a archivos fuera de la raíz web LFI Lograr ejecución remota de código RCE si CGI está...

OnlyOffice-path-traversal

Explotación de Path Traversal en ONLYOFFICE CVE-2023-46988 📌 Resumen Este script explota una vulnerabilidad de path traversal en ONLYOFFICE Document Server CVE-2023-46988 que permite a usuarios no autorizados copiar archivos arbitrarios del servidor. La vulnerabilidad existe en el endpoint...

cve-2021-42013.get

Apache 2.4.50 - Path Traversal o Ejecución Remota de Código cve-2021-42013.py es un script de Python que ayuda a encontrar la vulnerabilidad de Path Traversal o Ejecución Remota de Código en Apache 2.4.50. Se proporciona una instancia vulnerable de Docker para practicar con CVE-2021-42013 Si...

cve-2021-42013L

cve-2021-42013 Apache 2.4.50 Vulnerabilidad de recorrido de rutas Síguenos Youtube Twitter Telegram Vulnmachines.com...

cve-2021-42013

Apache 2.4.50 - Path Traversal o Ejecución Remota de Código cve-2021-42013.py es un script de Python que ayuda a encontrar la vulnerabilidad de Path Traversal o Ejecución Remota de Código en Apache 2.4.50. Se proporciona una instancia vulnerable de Docker para poner manos a la obra con...

SOC_287

SOC287 - Arbitrary File Read on Checkpoint Security Gateway CVE-2024-24919 Overview This repository contains a detailed walkthrough of the CVE-2024-24919 vulnerability affecting Check Point Security Gateways. The vulnerability allows arbitrary file read, potentially exposing sensitive system file...

CVE-2026-42048

CVE-2026-42048 PoC de CVE-2026-42048 Langflow Path Traversal / Eliminación Arbitraria de Directorios https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Descripción CVE-2026-42048: Vulnerabilidad de Eliminación Arbitraria de Directorios en Langflow Descripción: una...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Lectura de archivos no autorizada en Grafana Versiones afectadas: 8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Explota la vulnerabilidad de validación poco estricta del enrutamiento de URL en la interfaz /public/plugins de Grafana para leer...

day04-nexus-4956

Day 4 – Nexus Repository 3 Path Traversal CVE-2024-4956 What: Unauthenticated path traversal lets anyone download arbitrary files with a crafted URL. Vuln: Affects Nexus Repo 3 versions ≤ 3.68.0. Fixed in 3.68.1. Source: Sonatype advisory + NVD. Safety: Lab is local-only. Don’t target systems you...