134004 matches found
Custom-Metasploit-Modules
Custom Metasploit Modules This repository contains custom Metasploit modules created for educational and recreational purposes. Table of Contents Modules Loading Modules in Metasploit Usage Contribution Disclaimer Modules Below is a list of custom Metasploit modules available in this repository:...
Exploit for Path Traversal in Checkpoint Multi-Domain_Security_Management
Check Point Security Management Unauthenticated RCE — Vulnerab...
CVE-2024-58388 Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html
Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...
CVE-2024-58388 Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html
Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...
CVE-2024-58388
Sharp and Toshiba Tec rebranded multifunction printers are vulnerable to an unauthenticated local file inclusion (LFI) vulnerability. The root cause is the lack of input validation on the path parameter within the installed_emanual_down.html endpoint. Remote attackers can leverage directory trave...
CVE-2021-43798-EXPLOIT
CVE-2021-43798 - Grafana Directory Traversal 🔍 Grafana is an open-source platform for monitoring and observability. Versions 8.0.0-beta1 through 8.3.0 except for patched versions are vulnerable to a directory traversal attack, allowing unauthorized access to local files. This vulnerability does n...
CVE-2018-18778
CVE-2018-18778 - ACME minihttpd Arbitrary File Read CVE-2018-18778 is a security vulnerability affecting ACME minihttpd a lightweight web server. The vulnerability allows remote attackers to read arbitrary files on the server. It was publicly disclosed in October 2018 and impacts versions of...
CVE-2021-42013-EXPLOIT
🚨 CVE-2021-42013 - Apache 2.4.49 & 2.4.50 Remote Code Execution 🚨 CVE-2021-42013 builds upon the previously identified vulnerability, CVE-2021-41773. Despite the Apache team's efforts to address CVE-2021-41773 in version 2.4.50, subsequent investigations revealed that the fix fell short of fully...
Directory Traversal
Overview ansible-runner is a tool that helps when interfacing with Ansible directly or as part of another system whether that be through a container image interface, as a standalone tool, or as a Python module that can be imported. Affected versions of this package are vulnerable to Directory...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significan...
CVE-2026-103754
A flaw in ansible-runner 's unstream_dir() function allows for path traversal and symlink escape during the extraction of a streamed zip archive. The vulnerability exists because the function fails to validate symbolic link targets and applies chmod() and utime() to unsanitized filesystem paths d...
CVE-2026-103754 Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory
A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...
CVE-2026-103754 Ansible-runner: ansible-runner: path traversal and symlink escape in unstream_dir() allows file write outside the target directory
A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...
Grafana-cve-2025-4123
Grafana-cve-2025-4123 Result FOFA app="Grafana" Shodan product:"Grafana Open Source" SSRF http://localhost:3000/render/public/..%252f%255COpenRedirectURL%252f%253F%252f..%252f.. Open Redirect /public/..%2F%5cwebsite.com%2F%3f%2F..%2F...
CVE-2026-103263
A flaw was found in Tornado. The StaticFileHandler fails to verify that symbolic links shortcuts pointing to other files located within the static root directory resolve within that directory. An unauthenticated remote attacker can exploit this path traversal vulnerability by requesting a path...
CVE-2026-103290
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...
AZL-105375 CVE-2026-103263 affecting package python-tornado 6.3.3-11
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request...
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request...
DEBIAN-CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request...
CVE-2026-103257
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...