CVE-2026-55557

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browserdownload writes a fetched response body to joinsavedir, filename without validating the caller-controlled savedir, while browsersavestate and browserloadstate honor a caller-controlled path...

CVE-2020-1066-EXP

Referenz Diese Schwachstelle ist eine lokale Rechteausweitung durch beliebigen Dateiaustausch, die dadurch verursacht wird, dass der Windows CardSpace-Dienst Symlink-Objekte nicht ordnungsgemäß behandelt. Erklärung Der Autor stellt den PoC ausschließlich zu Forschungszwecken bereit. Wenn Leser...

CVE-2024-29404_Razer

CVE-2024-29404 Razer Synapse 3 =Synapse versione 3.9.131.20813 App versione =20240213 Vulnerabilità di elevazione dei privilegi nella funzionalità "Chroma Effects" tramite rimozione arbitraria di file/cartelle https://github.com/user-attachments/assets/6528f166-5514-4b10-b1a4-3644ec11e772...

CVE-2024-21111

CVE-2024-21111 Oracle VirtualBox precedente alla versione 7.0.16 è vulnerabile all'Elevazione Locale dei Privilegi tramite il seguimento di link simbolici, che porta alla cancellazione arbitraria di file e allo spostamento arbitrario di file. VirtualBox tenta di spostare i file di log come NT...

browse-mcp has an arbitrary file write via unconfined download and state paths

Impact browserdownload wrote a fetched file to joinsavedir, filename with no validation of savedir, and browsersavestate / browserloadstate honored an explicit path unchanged. The MCP caller controls these arguments a malicious MCP client, or an autonomous agent steered by indirect prompt injecti...

EUVD-2026-65581

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browserdownload writes a fetched response body to joinsavedir, filename without validating the caller-controlled savedir, while browsersavestate and browserloadstate honor a caller-controlled path...

CVE-2026-55557 browse-mcp: Arbitrary file write via unconfined download and state paths

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browserdownload writes a fetched response body to joinsavedir, filename without validating the caller-controlled savedir, while browsersavestate and browserloadstate honor a caller-controlled path...

CVE-2026-55557

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2 , the browser_download function writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, and browser_save_state / browser_load_state honor a cal...

CVE-2026-19913

CVE-2026-19913 affects the Kaltura HTML5 player (mwEmbed / html5lib), where improper validation of the ServiceUrl parameter in mwEmbedLoader.php allows non-HTTP schemes such as file://. When a backend request triggered by this parameter raises an exception, the raw response is deserialized and re...

CVE-2026-19912

The Kaltura HTML5 player (mwEmbed / html5lib) is affected by an unauthenticated remote code execution vulnerability rooted in two compounding flaws: unsafe deserialization of a user-controlled ServiceUrl response via unserialize() in mwEmbedLoader.php, and unsanitized filesystem path construction...

EUVD-2026-65614

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2021-44967

CVE-2021-44967: LimeSurvey RCE Beschreibung Dieser Proof-of-Concept POC kann verwendet werden, um CVE-2021-44967 auszunutzen, um ein bösartiges LimeSurvey PHP-Plugin als Administrator hochzuladen und auszuführen, um eine Reverse Shell zu erhalten. Eine Schwachstelle zur Remote Code Execution RCE...

CVE-2024-28995

CVE-2024-28995 Dichiarazione Questo strumento è destinato esclusivamente allo studio e alla ricerca sulla sicurezza personale. Qualsiasi conseguenza o perdita, diretta o indiretta, derivante dalla diffusione o dall'utilizzo di questo strumento è di esclusiva responsabilità dell'utente; l'autore...

CVE-2023-22974

CVE-2023-22974 OpenEMR 7.0.0 Beliebiges Dateilesen...

ATutor-Instructor-Backup-Arbitrary-File

ATutor-Instructor-Backup-Exploit عنوان الاستغلال: ATutor 2.2.4 'النسخ الاحتياطي' تنفيذ أوامر عن بعد CVE-2019-12170 دالة بحث جوجل: inurl:/ATutor/login.php التاريخ: 5/13/2019 مؤلف الاستغلال: liquidsky Joseph McPeters الصفحة الرئيسية للبائع: https://atutor.github.io/ رابط البرنامج:...

CVE-2025-3054-Exploit

CVE-2025-3054 الاستغلال: تحميل هنا التفاصيل معرف CVE : CVE-2025-3054 نشر : 5 يونيو 2025 CVSS : 8.8 التصحيح متوفر: لا يوجد تصحيح رسمي حتى الآن التأثير إضافة WP User Frontend Pro لـ WordPress معرضة لرفع الملفات بشكل عشوائي بسبب عدم التحقق من نوع الملف في دالة uploadfiles في جميع الإصدارات حتى الإصد...

CVE-2025-48384-POC

Per attivare, esegui git clone --recursive https://github.com/fishyyh/CVE-2025-48384-POC.git su una versione vulnerabile di git e troverai un file /tmp/sectest che appare improvvisamente...

POC_CVE-2024-36420

POCCVE-2024-36420 Laboratório de reprodução local e rascunho de template nuclei para CVE-2024-36420 que afeta o Flowise. Resumo CVE-2024-36420 é uma leitura arbitrária de arquivos no Flowise causada pelo uso não sanitizado do parâmetro fileName no corpo da requisição em: POST...

CVE-2026-39363

CVE-2026-39363 — PoC لقراءة ملفات تعسفية من Vite Dev Server PoC قابل للتشغيل مباشرة ضد GHSA-p9ff-h696-f583. عبر استدعاء fetchModule من خلال HMR WebSocket غير مُصادَق، يتم تجاوز قيود server.fs.allow على طبقة HTTP لقراءة أي ملف من الجهاز الذي يعمل عليه خادم التطوير dev server. نطاق التأثير...

CVE-2026-55527

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized userid into self.userpath. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitize...