CVE-2026-50024

GitHacker (a tool that restores Git repositories from exposed .git directories) is vulnerable to path traversal in versions 1.1.7 and earlier . The function add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated segments onto temp_dst/.git/logs/, while add...

Security Bulletin: IBM® Db2® could allow a DBADM authenticated user to send a specially crafted request to write arbitrary files on the system (CVE-2026-86087)

Summary IBM® Db2® could allow a database administration authority DBADM authenticated user to send a specially crafted request to write arbitrary files on the system CVE-2026-86087 Vulnerability Details CVEID:CVE-2026-86087 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 cou...

CVE-2026-43637-cornac

CVE-2026-43637: Path Traversal Tar Slip in Cornac via extractarchive Severity: High, CVSS 4.0 8.8 , Critical, CVSS 3.1 9.1assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Vector v4.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Affected:...

CVE-2026-56291

自动扫描版本及利用 CVE-2026-56291 POC Joomla Balbooa Forms 中未经身份验证的任意文件上传导致远程代码执行 FOFA / Shodan FOFA: body="combaforms" Shodan: http.html:"baforms"...

CVE-2026-0740

CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Subida de archivos arbitraria no autenticada a RCE Exploit para CVE-2026-0740 descubierta por Selim Lanouar whattheslime. Para una inmersión técnica completa, lea el artículo completo en el blog de Lexfo. Descargo de responsabilidad Este repositor...

CVE-2026-0740-mass

CVE-2026-0740 — Motor de Explotación Masiva Autor: 0xNuts Colaborador: Cursor Repositorio: https://github.com/ExDev994/CVE-2026-0740-mass PoC para CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Subida Arbitraria de Archivos sin Autenticación que puede llevar a RCE. La vulnerabilidad inicial f...

Security update for python310

This update for python310 fixes the following issues: Security issues fixed: CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives bsc1257599. CVE-2026-3219: pip doesn't reject concatenated ZIP bsc1262467...

CVE-2026-48939

CVE-2026-48939 — Exploit de RCE en iCagenda Joomla Subida de archivos arbitraria sin autenticación → Ejecución de código PHP Resumen CVE-2026-48939 es una vulnerabilidad crítica con CVSS 10.0 en la extensión de calendario de eventos iCagenda para Joomla. La función de adjuntar archivos del...

CVE-2020-14008

CVE-2020-14008 - ManageEngine Applications Manager 远程代码执行漏洞 Zoho ManageEngine Applications Manager（版本 示例 root@kitploit: 基础用法 python3 cve-2020-14008.py https://192.168.100.2:8443 admin admin 192.168.100.3 1337 漏洞利用流程 1. 登录 - 使用管理员凭据进行身份验证，获取会话Cookie 2. 枚举 - 获取ManageEngine基础安装目录 3. 构建JAR -...

CVE-2025-7441

CVE-2025-7441 StoryChief 1.0.42 - 任意文件上传 漏洞 CVE-2025-7441 - 技术总结 受影响组件： StoryChief WordPress 插件 漏洞类型： 未认证的任意文件上传 漏洞端点： /wp-json/storychief/webhook 根本原因： 该插件接受一个 JSON webhook 载荷，其中含有一个 URL（位于 data.featuredimage.data.sizes.full），并在此 URL 上执行服务器端 HTTP GET 请求，但缺少充分的验证（无域名白名单、MIME/内容检查不足，且文件保存于公共上传路径）。...

CVE-2026-44881_exploit

CVE-2026-44881 — Portainer Git 符号链接 → 任意主机文件读取 针对 CVE-2026-44881 的单脚本利用程序，该漏洞是 Portainer 堆栈部署流程中的一个 Git 符号链接注入，允许任何具有堆栈创建权限的低权限认证用户读取 Portainer 进程可访问的任意文件。 公告： GHSA-rpgq-m5fp-32wr 受影响版本： Portainer CE 2.33.0 – 2.33.7, 2.39.0 – 2.39.1, 2.40.x 修复版本： 2.33.8 LTS, 2.39.2 LTS, 2.41.0 STS 功能说明...

CVE-2025-30208

CVE-2025-30208 !IMPORTANT Descargo de responsabilidad Este exploit es solo para fines educativos y de pruebas de seguridad ética. El uso de este exploit contra objetivos sin consentimiento mutuo previo es ilegal, y el desarrollador rechaza cualquier responsabilidad por mal uso o daños causados po...

CVE-2025-4138_tarfile_filter_bypass

CVE-2025-4138 — Bypass del filter="data" de Python tarfile Escritura arbitraria de archivos fuera del directorio de extracción mediante una cadena de symlinks PATHMAX. Versiones afectadas Python 3.12.0 – 3.12.10 Python 3.13.0 – 3.13.3 Corregido en 3.12.11 / 3.13.4 Crédito: Reportero: Caleb Brown...

CVE-2023-2825-PoC

CVE-2023-2825-PoC 针对 CVE-2023-2825 的概念验证，这是 GitLab CE/EE 16.0.0 中的一个任意文件读取漏洞。 该脚本使用有效的 GitLab 账户登录，创建所需的公开嵌套组结构，创建一个公开项目，上传附件，并利用易受攻击的上传路径遍历行为从 GitLab 服务器读取目标文件。 它还支持复用现有上传路径，因此您无需为每次文件读取都创建新的组和项目。 功能说明 1. 向目标 GitLab 实例进行身份验证。 2. 使用短路径创建嵌套的公开组，以实现可靠的深层嵌套。 3. 在最深层的组内创建一个公开项目。 4. 向该项目上传一个小的附件。 5...

CVE-2025-39401

CVE-2025-39401 WordPress WPAMS Plugin WordPress WPAMS Plugin CVE: CVE-2025-39401 Base Score: 10.0 CRITICAL Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla WPAMS lets attackers upload a web shell to the server, leading to full compromise. This affects WPAMS versions: from...

CVE-2026-48907

CVE-2026-48907 - Joomla! JCE RCE sin autenticación Extensión Joomla! JCE 2.9.99.5 - Carga arbitraria de archivos PHP sin autenticación y ejecución remota de código 🔎 Consultas en motores de búsqueda Shodan...

CVE-2024-1561

CVE-2024-1561 - Lectura Arbitraria de Archivos en Gradio CVE-2024-1561 es una vulnerabilidad de lectura arbitraria de archivos que afecta a Gradio en versiones anteriores a la 4.13.0. Gradio es un popular framework de Python utilizado para construir rápidamente interfaces web para modelos de...

CVE-2026-91751

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and newid parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries director...

EUVD-2026-78167

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

PT-2026-92126

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...