Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

Jan v0.4.12 'readFileSync' - Path Traversal

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface. id: CVE-2024-36857 info: name: Jan v0.4.12 'readFileSync' - Path Traversal author: Yusuf Amr severity: high description: | Jan v0.4.12 was discovered to contain an arbitrary file rea...

YouPHPTube Encoder - Arbitrary File Write

Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. id: CVE-2019-5128 info: name: YouPHPTube Encoder - Arbitrary...

Jan v0.4.12 - Arbitrary File Upload

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-36858 info: name: Jan v0.4.12 - Arbitrary File Upload author: pussycat0x severity: critical description: | An arbitrar...

Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

BerqWP <= 1.7.6 - Arbitrary File Upload

The BerqWP Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/storewebp.php file in all versions up to, and including, 1.7.6...

Nextjs <2.4.1 - Local File Inclusion

ZEIT Next.js before 2.4.1 is susceptible to local file inclusion via the /next and /static request namespace, allowing attackers to obtain sensitive information. id: CVE-2017-16877 info: name: Nextjs 2.4.1 - Local File Inclusion author: pikpikcu severity: high description: ZEIT Next.js before 2.4...

pfSense - Arbitrary File Write

diagroutes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility, and then its output is parsed via the sed utility. Although the common protection...

WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload

The Frontend File Manager plugin 4.0 and N-Media Post Front-end Form plugin 1.1 for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. id:...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

CVE-2023-45878_to_RCE

CVE-2023-45878 到 RCE 此脚本通过利用 CVE-2023-45878，将 Gibbon LMS 上的任意文件写入链接并自动化到远程代码执行。 该脚本执行以下步骤： 1. 生成一个用于 Windows 的 msfvenom 无阶段反向 Shell 2. 上传一个利用 CVE-2023-45878 的 WebShell 3. 在目标上下载反向 Shell 4. 执行反向 Shell...

CVE-2023-1177

CVE-2023-1177 | | MLFlow パストラバーサル | MLflow 2.2.0 でテスト済み | ソース: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST "$URL/ajax-api/2.0/mlflow/registered-models/create" -d...

CVE-2023-29919

摘要： SolarView Compact 6.00 及以下版本存在任意文件读取漏洞，攻击者可绕过身份验证，通过 texteditor.php 读取文件。 厂商： SolarView Compact 受影响产品： SolarView Compact =ver 6.00 PoC： http://example.com/texteditor.php 详细信息： 通过访问 texteditor.php 页面，您可以填写要读取的文件位置。...

TotalCMS-Arbitrary_File-Upload--XSS_Steal_Cookies---TotalDepot

TotalCMS 任意文件上传 - XSS 与窃取 Cookie 作者：Sergio 描述： TotalCMS 受到任意文件上传 - XSS 漏洞的影响，该漏洞允许跨站脚本（XSS）以及窃取会话 Cookie。 攻击向量： “Total Depot” 文件上传过滤机制中的漏洞允许你上传带有隐藏 alert 的 PDF / SVG / HTML 文件以触发跨站脚本（XSS），并窃取用户 Cookie。 我将进行 2 个 PoC： - POC 1：PDF / SVG 和 HTML 文件的跨站脚本（XSS） - POC 2：窃取用户 Cookie 并将其转发到外部服务器以截获它们并冒充用户。...

Mysql-Readfile

简介 该项目主要利用 load data local infile 来获取攻击者的主机（Windows 平台）上的任意文件，需要访问的文件可以列在 file.txt 中。当我们在某些情况下能够控制 Mysql 的连接配置时，这将非常有意义。 项目使用方法 步骤 1：启动伪造的 Mysql 服务器 python2 Mysql-Read.py 步骤 2：连接恶意服务器 参考 https://mp.weixin.qq.com/s/rQ9BpavBeMnS6xUOidZ5OA https://mp.weixin.qq.com/s/m4IYDn98KA2yGAhv67Gg...

CVE-2022-30333

CVE-2022-30333（unRARバージョン6.11より前のパストラバーサル脆弱性）の概念実証です。AttackerKBの記事向けにエクスプロイトのデモとして作成し、近いうちにMetasploitモジュールに組み込む予定です！ 基本的には、ターゲット（パストラバーサルを含む）とファイルデータを指定すると、このツールがその場所にファイルを展開する.rarファイルを生成します。最大ファイル長は104バイト、最大ファイル長は4096バイトです。（これは脆弱性に固有のものではなく、ファイル生成時に私が選択したものです）。 例えば、msfvenom でバックドアを生成します：...

wp-file-manager-CVE-2020-25213

WP-file-manager expoit CVE-2020-25213 WP-file-manager wordpress plugin 6.9 vulnerable to unauthenticated arbitary file upload resulting in full compromise of the system. For More more details refer to my writeup published here Disclaimer I haven't discovered this vulnerability & neither taking an...

CVE-2021-21972

CVE-2021-21972 CVE-2021-21972 Works On VMware-VCSA-all-6.7.0-8217866、VMware-VIM-all-6.7.0-8217866 ✔ VMware-VCSA-all-6.5.0-16613358 ✔ For vCenter6.7 U2+ vCenter 6.7U2+ running website in memory,so this exp can't work for 6.7 u2+. Need test vCenter 6.5 LinuxVCSA/WindowWaiting For Test vCenter 6.7...

CVE-2019-3799

CVE-2019-3799 - Spring-Cloud-Config-Server 目录遍历漏洞 Spring Cloud Config 2.1.x 系列早于 2.1.2、2.0.x 系列早于 2.0.4、1.4.x 系列早于 1.4.6 的版本，以及更早的不受支持版本，允许应用程序通过 spring-cloud-config-server 模块提供任意配置文件。恶意用户或攻击者可以利用特制的 URL 发起目录遍历攻击。 发现者：Vern [email protected] 安全公告 https://pivotal.io/security/cve-2019-3799...

Vite-CVE-2025-30208-EXP

CVE-2025-30208 检测工具 漏洞分析 CVE-2025-30208是 Vite 开发服务器中的任意文件读取漏洞。攻击者可通过构造特殊路径（如 @fs 前缀）读取服务器敏感文件（如 /etc/passwd 或 C:\windows\win.ini）。本工具支持单目标检测、系统信息探测及深度环境分析，并提供代理功能以适配复杂网络环境。 功能特性 单目标检测 ：通过命令行参数指定单个目标 URL 进行漏洞验证。 系统信息探测 ：支持基础系统探测（操作系统类型、工作目录）和企业级深度检测（用户权限、Web服务配置、云环境指纹）。 代理支持 ：支持通过 HTTP/HTTPS...