CVE-2019-11510_poc

CVE-2019-11510 PoC 用于利用CVE-2019-11510并读取'/etc/passwd'文件的Python脚本 Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - 任意文件泄露漏洞 root@kitploit: USAGE: python3 CVE-2019-11510.py...

CVE-2020-11579

CVE-2020-11579 简介 PHPKB 9.0 企业版（MySQL 数据库） 存在一个通过恶意 MySQL 服务器触发的未认证任意文件读取漏洞。 远程攻击者只需发送单个 HTTP GET 请求，即可在远程受害主机上以 Web 服务器权限（例如 www-data）读取任意文件。 阅读更多：https://shielder.it/blog/mysql-and-cve-2020-11579-exploitation 说明 该脚本也可以以 server-only mode（仅服务端模式）运行，并提供一个独立的 MySQL 服务器，可用于类似的漏洞利用。 用法 root@kitploit:...

CVE-2019-11510-poc

CVE-2019-11510-poc Pulse Secure SSL VPN pre-auth 文件读取 参考 1. https://hackerone.com/reports/591295 2. https://github.com/projectzeroindia/CVE-2019-11510/blob/master/CVE-2019-11510.sh 3...

CVE-2022-24716

CVE-2022-24716 针对漏洞的利用：Icinga Web 2 版本低于2.8.6、2.9.6、2.10时的任意文件泄露漏洞 https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/ 帮助： python3 exploit.py -h 使用示例： python3 -u http://127.0.0.1:8080 -f /etc/passwd 免责声明：此脚本用于审计系统安全性。请仅在你自己的系统上或已获得书面授权的系统上使用。...

CVE-2006-3392

Webmin 1.290 / Usermin 1.220 - 任意ファイル開示の脆弱性を悪用するシンプルなツールです。 使用方法： 1-スクリプト python exploit.py を実行します。 2-ポートを入力します。 3-表示したいフォルダを選択します。 ⛔ 重要 ⛔ 本スクリプトを非倫理的な行為に使用した場合、当方は一切責任を負いません。...

Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure

Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplifypath function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted '..%01' sequences. id: CVE-2006-3392 info: name: Webmin 1.290 / Usermin 1.220 -...

Icinga Web 2 - Arbitrary File Disclosure

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. id: CVE-2022-24716 info:...

CVE-2026-76217

A flaw was found in GitPython where it fails to properly validate options provided to its git rm and git checkout commands. A remote attacker with low privileges could exploit this by supplying crafted parameters, such as --pathspec-from-file and --pathspec-file-nul. This vulnerability allows for...

CVE-2026-63179

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...

CVE-2026-63179 Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...

CVE-2026-54134 OctoPrint: File exfiltration possible via query parameters on upload endpoints

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

CVE-2026-77815

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

CVE-2026-73040 Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9-+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

CVE-2026-73973

Linuxfabrik Monitoring Plugins (for Icinga/Nagios) prior to 7.0.0 is vulnerable to arbitrary root file disclosure via the check-plugins/logfile/logfile plugin. The --filename parameter accepts a free-form path that is opened as root through the shipped sudoers allowlist, with no confinement to /v...

CVE-2026-73973 Linuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename in logfile plugin (sudoers LPE)

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confini...

CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646

Affected component: lib/previous-map.js in PostCSS

CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-72766

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...