Webapp_Pentast

CVE-2022-31147 개념 증명 및 수동 테스트 가이드 이 가이드는 널리 사용되는 matthiasmullie/minify 라이브러리에 영향을 미치는 심각한 경로 순회 취약점인 CVE-2022-31147을 테스트하기 위한 포괄적인 방법론을 제공합니다. 이 취약점은 공격자가 minify 엔드포인트의 입력 검증 부족을 악용하여 Linux 및 Windows 서버 모두에서 임의의 파일 읽기 작업을 가능하게 합니다. 이 가이드는 웹 애플리케이션의 이 위협에 대한 노출을 평가하려는 보안 전문가, 침투 테스터 및 연구자를 위해...

CVE-2024-24919

CVE-2024-24919 대량 자동 스캐너 이 스크립트는 원격 Check Point 방화벽에서 CVE-2024-24919 취약점을 스캔하기 위해 설계되었습니다. 악성 POST 요청을 보내 대상 서버에서 지정된 파일을 추출하여 취약점을 악용하려고 시도합니다. 스크립트 실행 제공된 스크립트를 massautoscanner.py와 같은 Python 파일로 저장합니다. 터미널 또는 명령 프롬프트를 엽니다. massautoscanner.py와 urls.txt 파일을 저장한 디렉토리로 이동합니다. 다음 명령을 사용하여 스크립트를 실행합니...

CVE-2026-37065

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion via the endpoint /vfm-admin/index.php?section=translations&action=update. The root cause is the unsanitized remove URL parameter, which allows an attacker to specify which file to delete. The vulnerability requires an authen...

CVE-2026-75339

cjbi admin3 v3.0.0 suffers from missing permission checks on the /storage/upload storage endpoint. Any logged-in user can upload arbitrary files, while any anonymous attacker can download them, enabling unauthorized file access and potential data exposure. The CVSS v3.1 score is 8.8 (High) (AV:N/...

CVE-2026-59682

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB.This issu...

PT-2026-82649

Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description A flaw in the domai...

CVE-2026-37068

An arbitrary file write vulnerability in Veno File Manager Project 4.4.9 affects the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user holding the super administrator role can overwrite any PHP file in the application by sending a specially crafted POST reque...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82786

A path traversal vulnerability exists in the built-in preview/development web server of Lektor 3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensiti...

CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability...

CVE-2026-37071

CVE-2026-37071 affects Veno File Manager Project 4.4.9 in the Actions::renameFile() function. An authenticated attacker holding the 'reanme' permission can send a specially crafted POST request that renames the application configuration file, triggering a configuration rebuild that resets super a...

CVE-2026-37066

CVE-2026-37066 affects Veno File Manager Project 4.4.9 , where a path traversal vulnerability in the endpoints /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php leads to arbitrary file read. An authenticated attacker with the super administrator role can disclose sensitive information by sen...

PT-2026-82768

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.7 Description The ip-customblock active response script contains a path traversal flaw allowing an attacker to create or delete arbitrary files on the filesystem with root privileges. The issue occurs because the...

CVE-2021-29447

CVE-2021-29447 - Exploit della vulnerabilità XXE di WordPress Descrizione Questo repository contiene un exploit per CVE-2021-29447, una vulnerabilità XXE XML External Entity presente in WordPress 5.7.0 e versioni precedenti. La vulnerabilità risiede nella libreria multimediale che elabora file WA...

CVE-2018-18778-Scanner

CVE-2018-18778-Scanner Scannt anfällige Versionen von minihttpd vor 1.30. ACME minihttpd vor 1.30 ermöglicht es entfernten Benutzern, beliebige Dateien zu lesen. Verwendung python3 CVE-2018-18778-Scanner.py...

CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

CVE-2026-47862

Spring Integration's ZipTransformer component is vulnerable to a path traversal issue when using the default ZipResultType.FILE result type. An attacker who can set the file_name message header on a message reaching the transformer can cause the resulting .zip archive to be written to an arbitrar...

zenml-CVE-2024-2083-POC

CVE-2024-2083 – PoC per lettura arbitraria di file in ZenML Questo repository dimostra come riprodurre CVE-2024-2083 , una vulnerabilità di lettura arbitraria di file in ZenML. Il problema consente a un attaccante di leggere file dal filesystem del server abusando del campo logs.uri nella richies...

CVE-2026-45504

CVE-2026-45504 Lettura File Exchange CVE-2026-45504 Exchange File Read Blog di Ricerca python3 CVE-2026-45504.py --attacker-ip 192.168.2.238 --attacker-port 9020 --creds [email protected] --password Hawktrace1 --target https://mail.exchange.local --target-file...