bl_sbx

blsbx itunesstored & bookassetd Sandbox Escape This repository contains a proof-of-concept demonstrating how maliciously crafted downloads.28.sqlitedb and BLDatabaseManager.sqlite databases can escape the sandbox of itunesstored and bookassetd on iOS. By abusing their download mechanisms, the POC...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download Handler Proof-of-concept for CVE-2026-18907 CVSS 7.5 High, CWE-23, a relative path-traversal vulnerability in the download file feature of TECNO Hi Browser com.talpa.hibrowser version 2.23.1.1. The browser trusted an attacker-controlled...

vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

CVE-2026-85706-gitlab-poc

CVE-2026-85706 Description GitLab CE/EE unauthenticated arbitrary file read vulnerability CVE-2026-85706. Affected versions: GitLab CE/EE 18.7 – 19.1.7 GitLab CE/EE 19.2.0 – 19.2.5 GitLab CE/EE 19.3.0 – 19.3.1 Patched versions: GitLab 19.1.8 GitLab 19.2.6 GitLab 19.3.2 Vulnerability Details The...

CVE-2019-19576

class.upload.php = 2.0.3 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verot.net Affected product - class.upload.php = 2.0.3 Tested on newly installed Ubuntu 19.10 with PHP7.3 and Apache/2.4.38 Specifically Debian/Ubuntu has been found to be vulnerable since they add the php,...

CVE-2024-2961

CVE-2024-2961 Uses CVE-2024-2961 to perform an arbitrary file read Usage Use with wrapwrap for maximum potency. usage: arbitrary-file-read.py -h -t TARGET -c CHAIN -ct CONTENTTYPE --prefix-len PREFIXLEN --suffix-len SUFFIXLEN options: -h, --help show this help message and exit -t TARGET, --target...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Arbitrary File Write + XML Injection → Remote Code Execution Table of Contents Overview Vulnerability Details Attack Chain Requirements Installation Configuration Usage How It Works Vulnerable Code Pre-Exploitation Checklist Tested On Disclaimer...

CVE-2023-35843

CVE-2023-35843 CVE-2023-35843 Arbitrary File Read Vulnerability...

ProxyLogon

ProxyLogon ProxyLogon is the formally generic name for CVE-2021-26855, a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin. We have also chained this bug with another post-auth arbitrary-file-write vulnerability,...

CVE-2025-5394

🚨 CVE-2025-5394 - Unauthenticated Arbitrary Plugin Upload in Alone Theme 📌 Affected Product: Alone – Charity Multipurpose Non-profit WordPress Theme Versions: 🚀 Example Usage: python3 CVE-2025-5394.py -help usage: CVE-2025-5394.py...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...

phpweb

phpweb Frontend Arbitrary File Upload...

CVE-2025-7847-POC

CVE-2025-7847 Wordpress Plugin Authenticated Subscriber Arbitrary File Upload POC Wordpress Plugin AI Engine 2.9.3 - 2.9.4 Proof Of Concept Please note that this vulnerability can only be exploited if the “Public API” option is enabled, which is disabled by default, and no Bearer Token is...

CVE-2026-73034-PoC

CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write CVSS 9.8 Critical · CWE-22 · GHSA/Issue 3104 Summary POST /api/v1/python/file/upload in DB-GPT v0.8.1 takes the user-id HTTP header and uses it raw as a path component : uploaddir = os.path.joinbasedir,...

CVE-2025-4138-poc

CVE-2025-4138 Auto-Sudo Generator A Python script to generate a malicious tar archive that exploits CVE-2025-4138 / CVE-2025-4517 Path Traversal via PATHMAX Truncation. Successfully exploiting this vulnerability allows an attacker to bypass tarfile extraction filters and write arbitrary files to...

CVE-2025-57176

CVE-2025-57176 CVE-2025-57176 - Siklu EtherHaul Series - Unauthenticated Arbitrary File Upload Affected Versions: Firmware 7.4.0 - 10.7.3 likely all versions since 7.4.0...

CVE-2018-0952-SystemCollector

SystemCollector PoC for Privilege Escalation in Windows 10 Diagnostics Hub Standard Collector Service Affected Products Windows 10 Windows Server Windows Server 2016 Visual Studio 2015 Update 3 Visual Studio 2017 Summary The Diagnostics Hub Packaging library, used by Windows Standard Collector...

pwn-pulse

pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability CVE-2019-11510 Script authored by braindead @BishopFox. Based on research by Orange Tsai and Meh Chang. Thanks also to Alyssa Herrera and 0xDezzy for additional insights. Huge thanks to bl4ckh0l3z for fixing,...

CVE-2026-75865

CVE-2026-75865 — WPLP Cookie Consent gdpr-cookie-consent ≤ 4.4.1 Proof-of-concept and technical write-up for CVE-2026-75865 , an unauthenticated arbitrary file upload leading to remote code execution in the WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent...

CVE-2026-21015-PHP-Filter-Chain-Arbitrary-File-Read

CVE-2026-21015 – PHP Filter Chain Arbitrary File Read Program Code PHP // vulnerable.php - Includes file based on user input via filter ?php $file = $GET'page'; // Attempt to sanitize by allowing only .php files, but vulnerable to filter wrapper include"php://filter/convert.base64-encode/resource...