CVE-2026-54520

CVE-2026-54520 ai-agent-automation workflow file step path traversal allowed read/write outside the expected directory. Primary advisory: GHSA-cm8g-8jfq-887p Researcher credit: @chaitanyagarware At a Glance...

Exploits_and_Advisories

Exploits y Avisos Repositorio que rastrea exploits, vulnerabilidades y avisos públicos que co-descubrí o co-redacté. CVEs CVE| ID| Objetivo| Descripción| Divulgación ---|---|---|---|--- CVE-2020-10881| ZDI-20-333| TP-Link Archer A7/C7| desbordamiento de pila DNS| Pwn2Own Tokyo 2019 CVE-2020-10882...

CVE-2021-43798-Grafana-Exp

Grafana V8. Arbitrary File Read Exploit – Batch Verification Script Vulnerability Description Grafana is an open-source metrics analysis and visualization suite. It is commonly used as a visualizer for time series data and application analytics in infrastructure, and is also widely adopted in oth...

CVE-2021-41773

CVE-2021-41773 Vulnerabilidad de path traversal y divulgación de archivos en Apache HTTP Server 2.4.49 CVE-2021-41773 Información Se encontró una falla en un cambio realizado en la normalización de rutas en Apache HTTP Server 2.4.49. Un atacante podría usar un ataque de path traversal salto de...

SimplesApachePathTraversal

SimplesApachePathTraversal Simples Apache Path Traversal Es una herramienta simple para probar la vulnerabilidad Apache Path Traversal https://blog.mrcl0wn.com/2021/10/uma-simples-tool-para-apache-path.html root@kitploit: Autor: MrCl0wn Blog: https://blog.mrcl0wn.com GitHub:...

CVE-2021-40978

CVE-2021-40978 mkdocs built-in dev-server directory traversal exploitation Mkdocs 1.2.2 allows directory traversal through the built-in dev-server which responds on port 8000. There is below some examples of successfully exploited paths: Impact Using this tecnique it is possible to fetch files...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

CVE-2025-6218-POC

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open...

CVE-2025-8088-Winrar-Tool-Gui

🚨 CVE-2025-8088 WinRAR Exploit Tool ⚠️ FOR EDUCATIONAL AND RESEARCH PURPOSES ONLY ⚠️ 🌐 Language / Dil 🇺🇸 English 🇹🇷 Türkçe English 📋 Table of Contents Overview Features Requirements Installation Usage Technical Details Screenshots Disclaimer Contributing 🎯 Overview CVE-2025-8088 is a fictional...

CVE-2026-15358

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...

SolarWinds-CVE-2021-35250

SolarWinds-CVE-2021-35250 Serv-U v.15.3.0.X CVE-2021-35250-Salto-de-directorio Hola a todos Este es mi primer POC, no juzguen con rigor. Descargo de responsabilidad El autor de este repositorio no se hace responsable por ningún daño causado por el uso o mal uso de estos PoC exploits. Estos PoC...

CVE-2026-35204

CVE-2026-35204 This repository represents a PoC to a CVE-2026-35204 Description "Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem...

CVE-2025-6218-WinRAR-Directory-Traversal-RCE

CVE-2025-6218-WinRAR-Directory-Traversal-RCE CVE-2025-6218 is a directory traversal vulnerability in WinRAR that allows an attacker to place files outside the intended extraction directory when a user extracts a specially crafted .rar archive. By exploiting this flaw, an attacker can drop malicio...

Elementor-3.18.0-Upload-Path-Traversal-RCE-CVE-2023-48777

This repository does not have a README...

cve-2026-87902-wordpress-lfi-lab

CVE-2026-87902 / GHSA-7hp8-65ch-5whp — LFI no autenticado en getpagetemplate de WordPress → RCE condicional Laboratorio de reproducción + escáner de listas de URL + PoC, construido y validado de extremo a extremo contra WordPress genuino 7.1.1 vulnerable y 7.1.2 parcheado en el laboratorio Docker...

CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal

🚨 CVE-2026-87902: WordPress Core Path Traversal No Autenticado y Mitigación de RCE 🔴 Mira el Análisis Completo y el Tutorial de Mitigación: 👉 Haz Clic Aquí para Ver en YouTube 📖 Descripción General Este repositorio proporciona notas de referencia de emergencia, reglas de mitigación para servidore...

CVE-2026-53940

A flaw was found in Conda, a system-level binary package and environment manager. An unvalidated entry-point command in a noarch:python package's metadata allows a malicious package to use path traversal. This enables writing files outside the intended installation directory or overwriting existi...

EUVD-2026-85237

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...

CVE-2026-15358 Path Traversal Vulnerability

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...

CVE-2026-93987

A flaw was found in rclone. The rclone serve docker volume plugin contains a path traversal vulnerability. A highly privileged attacker, by submitting a crafted Docker VolumeDriver.Create request with a malicious volume name, can cause the rclone plugin process to create a directory and mount a...