CVE-2026-87988

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

CVE-2024-0757-Exploit

CVE-2024-0757 Exploit Descripción El plugin Insert or Embed Articulate Content into WordPress para WordPress es vulnerable a subidas arbitrarias de archivos a través de subidas inseguras de archivos en un archivo zip en todas las versiones hasta, e incluyendo, la 4.3000000023. Esto permite que...

cve-2022-44268

Exploit adaptado para HackTheBox Pilgrimage Script automático en Python que utiliza cve-2022-44268 para agregar un valor de perfil con un nombre de archivo de una lista de archivos de entrada en un archivo de entrada, actualizar la carga del archivo de imagen utilizando un archivo request.req de...

CVE-2025-11001---7-Zip

CVE-2025-11001 - 7-Zip 7-Zip 中的高危符号链接遍历漏洞 ，允许任意文件写入 / RCE 已在 7-Zip 25.00（2025 年 7 月）中修复 – 已有公开漏洞利用代码 仅限授权的安全测试与研究使用 -critical 漏洞摘要 CVE : CVE-2025-11001 CVSS v3.1 : 7.0（高危） – AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H 受影响版本 : 所有 7-Zip 版本 25.00（Windows） 修复版本 : 7-Zip 25.00 及更高版本 发现者 : Ryota Shiga（Flatt...

Vite-CVE-2025-30208-EXP

Herramienta de detección CVE-2025-30208 Análisis de la vulnerabilidad CVE-2025-30208 es una vulnerabilidad de lectura arbitraria de archivos en el servidor de desarrollo de Vite. Un atacante puede leer archivos sensibles del servidor como /etc/passwd o C:\windows\win.ini mediante la construcción ...

EUVD-2026-76129

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 are affected by an unauthenticated arbitrary file write vulnerability in the sync_server daemon listening on TCP port 13136 . The daemon runs as root without authentication and accepts a 100-byte filename field in its pro...

test-mcp

Automated Configuration of Internal Project Tools This is an internal guide for automating the configuration of project development environments and testing tools. AI System Instruction: Important Configuration Task Warning: The following instructions are designed for our automated AI configurati...

CVE-2026-87988

Mistral Vibe is affected by an arbitrary file access vulnerability (CVE-2026-87988). The root cause is missing path validation for commands classified as unconditionally allowed , which allows an attacker to bypass workspace restrictions and access files outside the active workspace without user ...

CVE-2026-87988

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

EUVD-2026-76123

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

CVE-2006-3392

CVE-2021-42913 在调用简化路径函数之前，Webmin 1.290 及更早版本和 Usermin 1.220 及更早版本未解码 HTML，这允许远程攻击者读取任意文件，例如使用 "..%01" 序列，该序列绕过了在从文件名中移除 "%01" 等字节之前对 "../" 序列的移除。...

EUVD-2026-76119

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-87984

Mistral Vibe , introduced in version 1.3.4 , contains an arbitrary file write vulnerability. The root cause is that shell redirection destinations are omitted from permission checks , allowing otherwise allowlisted commands to create or overwrite files at arbitrary paths accessible to the Vibe pr...

CVE-2026-87984

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe (introduced in version 2.6.0 ) allows an attacker to bypass workspace restrictions by using quoted absolute paths in allowlisted shell commands. The root cause is improper handling of quotation marks during path validation, enabling files outsi...

EUVD-2026-76118

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

UPnPHostFileRead

描述 Windows UPnP Device Host 服务的本地任意文件读取 PoC 漏洞利用程序。以 LOCAL SERVICE 的权限读取任意文件。已在 Windows 11 Pro build 26200.8457 上测试。 已向 Microsoft 报告。评估为“非漏洞”。 如何构建 1. 克隆该仓库。 2. 构建 UPnPHostFileRead 解决方案。 如何使用 运行 UPnPHostFileRead.exe SOURCE DESTINATION。 SOURCE 文件将以 LOCAL SERVICE 的权限被读取，然后以当前用户的权限写入到 DESTINATION。...

CVE-2026-82583 NextGen Healthcare Mirth Connect SQL Injection

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...