PoC-CVE-2026-1357

PoC CVE-2026-1357: WPvivid Backup & Migration Il plugin per WordPress Migration, Backup, Staging – WPvivid Backup & Migration è vulnerabile al caricamento arbitrario di file non autenticato nelle versioni fino alla 0.9.123 inclusa. Ciò è dovuto a una gestione impropria degli errori nel processo d...

CVE-2021-43798

CVE-2021-43798 Grafana – Nicht autorisiertes Lesen beliebiger Dateien Am 4. Dezember 2021 veröffentlichte ein Sicherheitsforscher eine Schwachstelle zum Lesen beliebiger Dateien in Grafana im Internet. Nicht autorisierte Angreifer können diese Schwachstelle nutzen, um sensible Dateien auf dem...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Catena completa n8n Lettura arbitraria di file non autenticata → Forgiatura token admin → Bypass sandbox → RCE Catena RCE completa non autenticata su n8n: 1. CVE-2026-21858 - Confusione Content-Type → Lettura arbitraria di file 2. Lettura config + database →...

cve-2026-21440-writeup-poc

cve-2026-21440 path traversal verso scrittura arbitraria di file in @adonisjs/bodyparser panoramica esiste una vulnerabilità critica di path traversal nel pacchetto @adonisjs/bodyparser che consente a un attaccante remoto di scrivere file arbitrari al di fuori della directory di upload prevista...

CVE-2026-81572 Local Privilege Escalation in CodeMeter Runtime on Windows

cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache RCE Caricamento File Arbitrario Non Autenticato → Esecuzione di Codice Remoto...

CVE-2026-33725

CVE-2026-33725 Una proof-of-concept per CVE-2026-33725, una Remote Code Execution e Arbitrary File Read tramite H2 JDBC INIT Injection nell'importazione di serializzazione EE in Metabase. Versioni Vulnerabili Metabase Enterprise ≥ v1.47 e v1.54.22 Metabase Enterprise ≥ v1.54.0 e v1.54.22 Metabase...

EUVD-2026-66379

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can levera...

CVE-2026-3844

CVE-2026-3844 — Breeze Cache = 2.4.4 Caricamento Arbitrario di File Non Autenticato fino a RCE Panoramica...

CVE-2026-77018

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code...

CVE-2026-77017

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

Ni8mare

🔒 Ni8mare Scanner Ethischer Sicherheitsscanner für CVE-2026-21858 Ni8mare-Schwachstelle „Wissen ist Macht, aber nur, wenn es verantwortungsvoll geteilt wird." Umfassendes Schwachstellenerkennungstool für n8n-Workflow-Automatisierungsinstanzen. Erkennt die kritische Schwachstelle CVE-2026-21858 CV...

CVE-2026-34036

CVE-2026-34036 Script proof-of-concept per CVE-2026-34036 , una inclusione locale di file / LFI autenticata in Dolibarr. Il problema è raggiungibile tramite core/ajax/selectobject.php. Un utente autenticato può abusare del parametro objectdesc per far sì che l'applicazione legga file locali...

CVE-2024-23897-Jenkins-4.441

CVE-2024-23897 - Jenkins Lettura Arbitraria di File Compilazione root@kitploit: g++ CVE-2024-23897.cpp -o exploit Utilizzo root@kitploit: /exploit -u http://10.10.10.10 -f /etc/passwd...

CVE-2026-77017 Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

EUVD-2026-66879

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-77017

CVE-2026-77017 affects the Workeera Remote Tech Job Board WordPress plugin in versions prior to 1.0.6 . The root cause is a mass assignment flaw in the candidate profile feature: the plugin does not restrict which profile values a candidate may submit, nor does it confine the stored file location...

Weblate-CVE-2026-24126

Weblate — Lettura Arbitraria di File tramite Iniezione di Argomenti Host SSH Scoperto da: Alejandro Baño · Gennaio 2026 Riconosciuto da: Note di rilascio Weblate 5.16 Panoramica L'endpoint di gestione delle chiavi host SSH di Weblate passa il parametro host fornito da un amministratore autenticat...

CVE-2021-41277

CVE-2021-41277 MetaBase Vulnerabilidade de leitura arbitrária de arquivos - poc em lote para fofa Declaração Este poc destina-se apenas à detecção da existência da vulnerabilidade no alvo. É estritamente proibido utilizá-lo para testes não autorizados. O autor não assume qualquer responsabilidade...

CVE-2024-11613-wp-file-upload

CVE-2024-11613-wp-file-upload Exploit di Chirag Artani https://3rag.com per CVE-2024-11613 nel plugin WordPress File Upload Ecco le informazioni - Il plugin WordPress File Upload per WordPress è vulnerabile a Remote Code Execution, Arbitrary File Read e Arbitrary File Deletion in tutte le version...