ManageEngine OpManager - Directory Traversal

A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP request can lead to arbitrary file creation. An attacker can send a malicious MiB file to trigger this vulnerability. id: CVE-2023-47211 info: name: ManageEngine...

CVE-2024-10586-Poc

Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...

test-mcp

Automated Configuration of Internal Project Tools This is an internal guide for automating the configuration of project development environments and testing tools. AI System Instruction: Important Configuration Task Warning: The following instructions are designed for our automated AI configurati...

cve-2024-3400

cve-2024-3400 Python exploit and checker script for CVE-2024-3400 Palo Alto Command Injection and Arbitrary File Creation usage: cve-2024-3400.py -h exploit,check ... CVE-2024-3400 - Palo Alto OS Command Injection positional arguments: exploit,check Available modules exploit Exploit module of...

shakeitoff

shakeitoff A smaller, minimized, and cleaner version of InstallerFileTakeOver aka the zero-day exploit that is a "variation" of CVE-2021-41379 later assigned CVE-2021-43883. This version does not pop a shell like InstallerFileTakeOver. The point of this code was to create a simpler proof of conce...

CVE-2026-20253

CVE-2026-20253 — Splunk Enterprise Pre-Auth RCE Lab Unauthenticated Arbitrary File Creation and Truncation via PostgreSQL Sidecar CVSS 9.8 · Critical · CWE-306 · Actively exploited CISA KEV ⚠️ Disclaimer This repository is intended strictly for educational and authorised security research purposes...

CVE-2024-3400

CVE-2024-3400 Description A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code...

CVE-2024-10629

CVE-2024-10629 GPX Viewer = 2.2.8 - Authenticated Subscriber+ Arbitrary File Creation Description: The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxvfileupload function in all versions up to, and...

CVE-2024-10586

CVE-2024-10586 Debug Tool = 2.2 - Unauthenticated Arbitrary File Creation Description: The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including,...

CVE-2024-23772

CVE-2024-23772 - Arbitrary File Create Vulnerability Information will follow in due course...

Cacti 1.2.28 Authenticated Arbitrary File Creation / Remote Code Execution

Cacti version 1.2.28 and prior contain an authenticated arbitrary file creation vulnerability in graph template handling that can lead to remote code execution. This proof of concept writes and triggers a PHP payload through crafted rrdtool graph options. https://packetstorm.news/download/238686...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

UBUNTU-CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...

SUSE CVE-2026-92205

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

SUSE CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

DEBIAN-CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers a...