-CVE-2023-33177-

Xibo CMS CVE-2023-33177 Vulnerability Tester Automated security testing tool for CVE-2023-33177 - Zip Slip Path Traversal vulnerability in Xibo CMS that leads to Remote Code Execution RCE. ⚠️ Disclaimer This tool is for educational and authorized testing purposes only. Only use on systems you own...

CVE-2025-47273-PoC

CVE-2025-47273: setuptools version 78.1.0 - Path Traversal in setuptools.packageindex Disclaimer This Proof of Concept PoC is intended for educational purposes and authorized security auditing only. The author assumes no responsibility for misuse of this information. Unauthorized access to comput...

APACHE-PATH-TRAVERSAL-RCE-CVE-2021-41773-

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal / RCE Educational research project. All testing was performed in an isolated Docker lab. Do not use against any system you do not own. Vulnerability Summary Field| Detail ---|--- CVE ID| CVE-2021-41773 Affected Software| Apache HTTP Server...

CVE-2018-14847

🐞 MikroTik CVE-2018-14847 Unauthenticated path traversal in MikroTik's Winbox protocol leaking admin credentials from /flash/rw/store/user.dat 📑 Table of Contents Overview Affected Versions Vulnerability 📂 Winbox Protocol Path Traversal Password Decryption Developer Backdoor Exploit References 📋...

CVE-2026-84275

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

Exploit for Path Traversal in Rubyonrails Rails

Ruby on Rails Accept Header File Disclosure CVE-2019-5418...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-82896 DESCRIPTION: IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

Exploit for Path Traversal in Unbit Uwsgi

uWSGI PHP Plugin Path Traversal CVE-2018-7490 Vulhubhttp...

CVE-2026-53519

Lab CVE-2026-53519 - Nezha Dashboard pre-auth path traversal Lab tai hien lo hong pre-auth path traversal via/dashboard.. prefix confusion trong Nezha Dashboard, dan toi leak jwtsecretkey - forge JWT - chiem quyen admin. Moi truong Docker, tach A/B theo version de so sanh vuln vs patched. | Image...

CVE-2026-77578

CVE-2026-77578 — Xibo CMS Arbitrary Local File Read Overview CVE-2026-77578 is an authenticated Arbitrary Local File Read vulnerability in Xibo CMS. An authenticated user with Admin privileges or Module Templates access can import a crafted XML template containing a path-based asset with a...

CVE-2026-74239

CVE-2026-74239: Windows path traversal in style archive import XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows. What happens The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or...

vault-cve-2026-5006-audit

CVE-2026-5006 toolkit HCSEC-2026-32 Two tools for working through the Vault templated-policy slash-injection vulnerability: an interactive walkthrough for explaining and scoping the issue, and an audit script that checks a live cluster and writes the findings to Markdown...

CVE-2026-9335-keras-hdf5-externallink

CVE-2026-9335 — Keras HDF5 ExternalLink local file-content disclosure Two public Keras APIs — keras.saving.KerasFileEditor and keras.saving.loadweights / model.loadweights — read HDF5 group members by direct indexing without a link-type check. h5py auto-dereferences ExternalLink / SoftLink on...

Project-CVE-2026-75604

Next.js Windows Cache Traversal Security Research Defensive security research and authorized validation only. This repository concerns CVE-2026-75604 , a critical vulnerability that may permit unauthenticated remote code execution on certain Windows-hosted Next.js deployments. Credits Coded by:...

CVE-2026-21962

CVE-2026-21962 — Oracle HTTP Server / WebLogic Server Proxy Plug-in Access-Control Bypass via URI Normalization Inconsistency An independently reproduced exploit and analysis for CVE-2026-21962 improper access control, CVSS 10.0 in Oracle HTTP Server / the Oracle WebLogic Server Proxy Plug-in for...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite putcontents $dir . $name, $item'data' ; The filename ../../plugins/shell.php concatenated with $dir wp-content/uploads/crm-attachments/ resolves to wp-content/plugins/shell.php — a directory...

halo-2.25.4-backup-write-CVE-2026-67920

Halo CMS Backup Restore Arbitrary File Write Vulnerability Summary A critical arbitrary file write vulnerability exists in the backup restoration functionality of Halo CMS versions up to 2.25.4. The restoreWorkdir method in MigrationServiceImpl.java copies the workdir/ directory from a...

CVE-2026-26336-PoC

CVE-2026-26336 — Alfresco Share Unauthenticated File Read Overview Alfresco Share exposes a /share/page/resource/ endpoint used to serve static resources. In vulnerable versions, this endpoint does not properly restrict path traversal, allowing an unauthenticated attacker to read arbitrary files...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms Fix A drop-in WordPress plugin that blocks the vulnerable Demo Import handler in FunnelForms Pro ≤ 3.8.1 to mitigate Remote Code Execution CVE-2026-39440, CVSS 9.9. The Vulnerability Field| Value ---|--- CVE ID| CVE-2026-39440 CVSS Score| 9.9 Critical Affected|...

CVE-2025-63298

CVE-2025-63298 A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/managewebsite.php component. An authenticated user with administrative privileges can leverage this flaw by submitting a specially crafted POST request, enabling...