EUVD-2026-80005

An insufficient check allowed for the overwrite of arbitrary files via a symlink...

CVE-2026-68491

SolusVM 1 is affected by an insufficient check that allows the overwrite of arbitrary files via a symlink , enabling a guest-to-host privilege escalation . The vulnerability is scored CVSS 4.0: 9.4 (CRITICAL) with a network attack vector, low complexity, and low privileges required, resulting in ...

CVE-2024-0132

CVE-2024-0132 CVE-2024-0132 PoC 让我们从确定基础镜像开始。系统中库的排列方式取决于所选的基础镜像。例如，对于 alpine，库目录将是 /usr/lib64/；对于 ubuntu，则是 /usr/lib/x8664-linux-gnu。我们将使用 ubuntu 作为基础镜像。 root@kitploit: FROM ubuntu NVIDIA 容器工具包会检查容器内 /usr/local/cuda/compat/ 中的库，然后将它们挂载到主库目录；对于这个镜像（ubuntu），主库目录就是 /usr/lib/x8664-linux-gnu。...

CVE-2021-41773

CVE-2021-41773 Apache バージョン 2.4.49 シンプルな PoC スクリプトの使い方 chmod +x apache.sh ./apache.sh 例 ./apache.sh http://127.0.0.1 etc/passwd...

flowise-arbitrary-file-read-getFileFromStorage

Flowise の未認証任意ファイル読み取り（getFileFromStorage）— 提案中の新規 CVE CVE-2025-71338（ 書き込み シンク）とは別の脆弱性 です。これは、Flowise のドキュメントストアローダー「rehydrate」パスにおける未認証の任意ファイル読み取り であり、影響を受けるのは 1.7.1 – 2.2.3 、2.2.4 で修正されました。/root/.flowise/encryption.key を読み取ると、保存されているすべてのプロバイダー資格情報を復号する鍵が得られます → 資格情報が完全に漏洩します。 目次...

CVE-2019-11510-PulseVPN

CVE-2019-11510-PulseVPN 在 Pulse Secure Pulse Connect Secure PCS 8.2 至 8.2R12.1 之前、8.3 至 8.3R7.1 之前以及 9.0 至 9.0R3.4 之前的版本中，未经身份验证的远程攻击者可发送特制 URI 以执行任意文件读取漏洞。 exploit.sh = 漏洞利用检测。 detect-pulse.sh = 检查一组 IP 地址中哪些正在运行 Pulse Secure。 dr4x-wordlist.sh = 以字典列表的形式触发 exploit.sh，读取文件中多个站点并判断其是否易受攻击。...

CVE-2024-23897-Arbitrary-file-read

🤵🏻 CVE-2024-23897 Arbitrary-file-read 🤵🏻 Affected versions: Jenkins 2.441 and earlier. Jenkins LTS 2.426.2 and earlier. A Python script to automate the vulnerability CVE-2024-23897 🤖 🛠️ This Python code presents a scanner for a specific vulnerability CVE-2024-23897 in Jenkins servers. It starts by...

CVE-2026-76796

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access...

CVE-2026-76796

The LoadImageAsPngBase64 endpoint of Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, enabling a local attacker to read arbitrary image files from the host filesystem outside the intended scope. The vulnerability is rated CVSS 3.1: 4....

EUVD-2026-79626

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access...

CVE-2026-13714

CVE-2026-13714 Realtyna Organic IDX 插件 + WPL Real Estate │ │ ├─ privatekey = │ │ ├─ cmd = setproperty │ │ └─ file = imageNxabc.php │ │─────────────────────────────────────────►│ │ │ API validates keys ✓ │ │ Saves file no type check │ "success": true │ │◄─────────────────────────────────────────│ ...

CVE-2021-31800-Impacket-SMB-Server-Arbitrary-file-read-write

CVE-2021-31800 - Impacket SMB 서버 임의 파일 읽기/쓰기 CVSS 벡터 : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS 점수 : 9.9 심각 설명 smbserver.py에 존재하는 경로 탐색path traversal 취약점으로 인해 공격자가 서버의 임의 파일을 읽거나 쓸 수 있습니다. 이 문제에 대한 자세한 설명: https://checkmarx.com/blog/cve-2021-31800-how-we-used-impacket-to-hack-itself/ 사용법...

CVE-2026-76687

HPE Networking EdgeConnect SD-WAN Orchestrator is affected by a vulnerability in its API endpoint involving an authenticated arbitrary file write that can lead to remote code execution . A low-privilege authenticated remote attacker can exploit this flaw to escalate privileges and execute arbitra...

CVE-2026-81568

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

CVE-2024-2928

CVE-2024-2928 mlflow の CVE-2024-2928 における任意ファイル読み取りエクスプロイト（具体的にはバージョン 2.9.2 が対象で、バージョン 2.11.3 で修正されました） このエクスプロイトコードは Linux でテスト済みです ソース: https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298 使用方法: python3 CVE-2024-2928.py -t 127.0.0.1 -p 5000 実行後、ファイルのフルパスを指定します...

CVE-2026-84048

CVE-2026-84048 affects the JoomGallery Joomla extension (joomgalleryfriends.net) in versions

EUVD-2026-79182

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery 4.4.1 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server...

CVE-2026-81568 Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

EUVD-2026-79291

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

CVE-2026-81568

J2Store (Joomla extension by j2commerce.com), versions 1.0.0–3.3.2, 4.0.0–4.0.22, 4.1.0–4.1.7 , is vulnerable to arbitrary file read via the task=download endpoint. The root cause is in J2StoreModelOrderdownloads::getFilePath(), which concatenates the configured attachment folder with the stored ...