CVE-2023-51802

CVE-2023-51802 Simple Student Attendance System v.1.0 - Cross-site scripting XSS vulnerabilities in attendancereport Description : Cross Site Scripting vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the "page...

CVE-2020-17518

Apache Flink directory traversal vulnerability, allows remote file read/write via REST API Vulnerability ID: CVE-2020-17518 Vulnerability Description: CVE-2020-17518: Write remote files via REST API Affected Versions: Flink 1.5.1-1.11.2 Safe Versions: Flink 1.11.3 or Flink 1.12.0 Flink 1.5.1...

CVE-2024-9932-POC

CVE-2024-9932-POC Description: The Wux Blog Editor WordPress plugin is vulnerable to arbitrary file uploads due to insufficient file type validation in the wuxbtinsertImageNew function. Versions up to and including 3.0.0 are affected. This vulnerability allows unauthenticated attackers to upload...

xiaomi-cve-2024-45352

xiaomi-cve-2024-45352 Reporte técnico sobre vulnerabilidad crítica de Xiaomi Vulnerability Summary A vulnerability was discovered in Xiaomi's default browser com.android.browser on various MIUI devices. The app fails to properly validate intents passed via startActivity, allowing malicious apps t...

CVE-2023-20178

CVE-2023-20178 This is PoC for Arbitrary File Delete vulnerability in Cisco Secure Client tested on 5.0.01242 and Cisco AnyConnect tested on 4.10.06079. When a user connect to vpn, vpndownloader.exe process is started in background and it will create directory in c:\windows\temp with default...

Grafana-Decryptor-for-CVE-2021-43798

Grafana Decryptor for CVE-2021-43798 This script decrypts the DataSource passwords from a Grafana instance vulnerable to CVE-2021-43798, which allows unauthorized arbitrary file reading. Description Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a directory traversal vulnerability...

CVE-2025-21420_POC

Diffing cleanmgr.exe The new version of cleanmgr.exe includes a call to the SetProcessMitigationPolicy function. With MitigationPolicy set to 16, corresponding to ProcessRedirectionTrustPolicy. Combined with Microsoft's description of CWE-59: Improper Link Resolution Before File Access 'Link...

CVE-2021-21349

CVE-2021-21349 XStream SSRF XStream Official Announcement CVE-2021-21349 Vulnerability CVE-2021-21349: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host. Affected Versions...

CVE-2020-37278

Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...

GHSA-8MCX-5RQC-VHMF Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...

Cve-2025-8088-WinRar-vulnerability

Cve-2025-8088 WinRAR Herramienta en Python que crea un archivo RAR malicioso para explotar la vulnerabilidad CVE-2025-8088 en WinRAR. La vulnerabilidad CVE-2025-8088 permite la explotación de archivos RAR manipulados para provocar path traversal y sobrescribir archivos arbitrarios en el sistema d...

cloudpanel-2.4.2-CVE-2024-44765-recovery

CVE-2024-44765 is an Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel versions 2.0.0 to 2.4.2 1. Follow instructions in every folder this should be done locally 2. Reset Passwords and Access for root $ sudo passwd root while for users $ getent...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

Exploit-CVE-2026-18351

Exploit-CVE-2026-18351 Drag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.🔥 𝘾𝙤𝙣𝙩𝙖𝙘𝙩: 𝙔𝙤𝙧𝙪 يورو 🔥 https://t.me/ChiefYoru — Channel https://t.me/TeamLeets — Group https://t.me/ChiefYoruPoCs...

Limesurvey-RCE

Limesurvey-RCE LimeSurvey Authenticated RCE Proof of Concept: 1. Create your files config.xml and php reverse shell files 2. Create archive with these files 3. Login with credentials 4. Go Configuration - Plugins - Upload & Install 5. Choose your zipped file 6. Upload 7. Install 8. Activate plugi...

CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment

CVE-2022-44268 ImageMagick Arbitrary Local File Read https://www.metabaseq.com/imagemagick-zero-days/ Based on the PoC CVE-2022-44268 ImageMagick Arbitrary File Read PoC, I created a vulnerability testing environment by using docker. Usage get image docker pull y1nglamore/cve202244268:latest you...

IHxExec

IHxExec POC to execute arbitrary code on behalf of another user. U can read more about the technique here: https://cicada-8.medium.com/process-injection-is-dead-long-live-ihxhelppaneserver-af8f20431b5d https://www.youtube.com/watch?v=bK3ufqZxkxc Note the attached video:...

CVE-2025-4602

eMagicOne Store Manager for WooCommerce = 1.2.5 - Unauthenticated Arbitrary File Read The eMagicOne Store Manager for WooCommerce plugin exposes a remote management protocol endpoint ?connector=bridge that allows file deletion operations on the server. The authentication mechanism relies on a...

GHSA-5FQC-MRG8-W798 Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

CVE-1999-1053-PoC

CVE-1999-1053 Proof-of-Concept Exploit Background This Proof-of-ConceptPoC exploit is inspired from a CTF web challenge called CVE 1999 in HKCERT CTF 2022. Writeup link Information Description: In Matt Wright Guestbook The Matt Wright guestbook.pl = v2.3.1 CGI script contains a flaw that may allo...