1723 matches found
CVE-2021-41773
CVE-2021-41773 CVE-2021-41773 POC डॉकर के साथ कॉन्फ़िगरेशन httpd.conf फ़ाइल को अनुकूलित करने के लिए, अनुभाग में पंक्ति 251 को Require all denied से Require all granted में बदलें। root@kitploit: AllowOverride none Require all granted अपने प्रोजेक्ट में एक Dockerfile बनाएँ root@kitploit: FROM...
Open WebUI 'LDAP Empty Password' - Authentication Bypass
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...
CVE-2018-6574
CVE-2018-6574...
CVE-2021-41773-i-
CVE-2021-41773 CVE-2021-41773 POC com Docker Configuração Para personalizar o arquivo httpd.conf, altere a linha 251 na seção de Require all denied para Require all granted. root@kitploit: AllowOverride none Require all granted Crie um Dockerfile no seu projeto root@kitploit: FROM httpd:2.4.49 CO...
EUVD-2026-66804
yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...
Astra Linux – Vulnerability in Zabbix
The request to LDAP is sent before checking the user permissions...
CVE-2026-67361
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...
UBUNTU-CVE-2026-68939
Pyenv provides simple Python version management. Prior to 2.8.0, isve...
CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php
Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...
CVE-2026-74884
opensslencrypt versions before 1.4.0 contain a path traversal vulnerability in the issafepath method where the pluginid parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious pluginid containing path traversal sequences like '../' to...
EUVD-2026-60103
opensslencrypt versions before 1.4.0 contain a path traversal vulnerability in the issafepath method where the pluginid parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious pluginid containing path traversal sequences like '../' to...
CVE-2026-74884
The WordPress plugin openssl_encrypt (versions before 1.4.0) has a path traversal flaw in the _is_safe_path method. The unsanitized plugin_id parameter is used to build a plugin config directory path, allowing attackers to inject ../ sequences and read arbitrary directories outside the intended p...
The vulnerability of Apache ActiveMQ software lies in the incorrect path name restrictions for the directory, which allows attackers to compromise the confidentiality of the protected information.
The vulnerability of Apache ActiveMQ software products is related to incorrect restrictions on path names to the directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of the protected information...
CVE-2026-73218 Cursor: Sandbox escape via launching privileged containers
Cursor is a code editor built for programming with AI. Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read and write access...
CVE-2026-17542
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...
CVE-2026-55747
The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
EUVD-2026-52022
In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...
