CVE-2023-45878

CVE-2023-45878 GibbonEdu Gibbon Exploit バージョン 25.0.1 GibbonEdu Gibbon バージョン 25.0.1 以前 GibbonEdu Gibbon バージョン 25.0.1 以前では、任意のファイル書き込みが可能です。 詳細情報 https://nvd.nist.gov/vuln/detail/CVE-2023-45878 https://herolab.usd.de/security-advisories/usd-2023-0025/ 免責事項...

CVE-2023-29384

CVE-2023-29384 CVE-2023-29384 WordPress Job Board and Recruitment Plugin 向け自動エクスプロイター 脆弱性タイプ: 任意のファイルアップロード...

CVE-2026-31156

CVE-2026-31156 OpenPLC-v3 において、コマンドラインから渡されたファイルパスパラメータに対して妥当性チェックを行わないことに起因するパスインジェクションの脆弱性があります。攻撃者は悪意のあるパスを構築することで任意の読み取り可能なファイルを読み取ることができ、情報漏洩のリスクがあります。 脆弱性タイプ 不適切な入力検証（パスインジェクション） 情報漏洩（任意ファイル読み取り） 脆弱性概要 gluegenerator.cpp からコンパイルされたバイナリプログラムには、ユーザーが指定したファイルパスの検証不足に起因する任意ファイル読み取りの脆弱性が含まれています。...

CVE-2026-40058

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2019-14751_PoC

CVE-2019-14751PoC CVE-2019-14751을 위한 개념 증명PoC 취약점 설명 NLTK Downloader 3.5 이전 버전은 디렉터리 트래버설directory traversal에 취약하여, 압축 해제 과정에서 부적절하게 처리되는 NLTK 패키지ZIP 아카이브 내의 ../ dot dot slash를 통해 공격자가 임의의 파일을 쓸 수 있습니다. 자세한 내용은 다음을 참조하십시오: https://salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751/ 재현 단계 1...

npm-tar-path-traversal-scanner

CVE-2026-31802 — npm tar 경로 탐색 스캐너 아카이브 추출 중 임의 파일 쓰기를 허용하는 tar npm 패키지의 경로 탐색 취약점인 CVE-2026-31802 에 취약한 npm 패키지를 탐지합니다. 기능 취약한 tar 버전이 있는지 package-lock.json을 스캔합니다 nodemodules에서 설치된 취약 패키지를 확인합니다 조작된 tar 아카이브로 추출 동작을 테스트합니다 취약한 tar로 이어지는 의존성 체인을 식별합니다 여러 프로젝트의 일괄 스캔을 지원합니다 JSON/CSV 보고서 생성 조치 권장 ...

EUVD-2026-79123

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

CVE-2026-40058

CrowdStrike Falcon sensor for Windows is affected by a vulnerability in the Microsoft Office File Malicious Macro Removal policy setting that allows an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation . The flaw requires t...

CVE-2021-33564

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Usage Arbitrary File Read python3 poc.py -u https:///system/refinery/images -r /etc/passwd Arbitrary File Write python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.txt -lu http:...

cve-2024-23897-jenkins-poc

CVE-2024-23897: Jenkins 임의 파일 읽기 args4j @-Syntax CVE-2024-23897 의 완전한 로컬 재현으로, Jenkins CLI의 치명적인 CVSS 3.1 기본 점수 9.8 임의 파일 읽기 취약점입니다. 이 프로젝트는 Jenkins 마이너 버전만 다른 두 개의 Docker 스택을 실행하고, 동일한 개념 증명을 두 스택에 대해 수행하여, 패치되지 않은 컨트롤러에서 취약점이 발생하고 패치된 컨트롤러에서는 조용해지는 것을 보여줍니다. 모든 것은 단일 Python 프로그램인 poc.py에 의해...

AZL-103140 CVE-2026-79699 affecting package containerized-data-importer 1.62.0-7

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

OnlyOffice-path-traversal

ONLYOFFICE Path Traversal Exploit CVE-2023-46988 📌 Overview This script exploits a path traversal vulnerability in ONLYOFFICE Document Server CVE-2023-46988 that allows unauthorized users to copy arbitrary files from the server. The vulnerability exists in the /example/editor endpoint, where the...

CVE-2024-34693

CVE-2024-34693: Server Arbitrary File Read in Apache Superset Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with localinfile enabled. By enabling localinfile in the Superset MySQL/MariaDB client and pointing the...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox Prior to 7.0.16 is vulnerable to Local Privilege Escalation via Symbolic Link Following leading to Arbitrary File Delete and Arbitrary File Move. VirtualBox attempts to move log files as NT AUTHORITY\SYSTEM in C:\ProgramData\VirtualBox which all users can write to...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana Unauthorized File Read Affected versions: 8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Exploit the Grafana /public/plugins endpoint's lax URL route validation vulnerability to read arbitrary local files from the server. poc:...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 MiNi Exploitation Framework Command-line automation tool for authorized security testing of Grafana Directory Traversal CVE-2021-43798. Overview CVE-2021-43798 is an unauthenticated directory traversal vulnerability in Grafana 8.x that allows attackers to read...

CVE-2026-4882

CVE-2026-4882 User Registration Advanced Fields = 1.6.20 - 認証なし任意ファイルアップロード 説明 : User Registration Advanced Fields = 1.6.20 - 認証なし任意ファイルアップロード WordPress用プラグイン「User Registration Advanced Fields」バージョン1.6.20以下 は、AJAXアクション urafprofilepictureuploadmethodupload...

CVE-2026-91940

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91934

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-87791

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...