CVE-2026-19264

CVE-2026-19264 - Unauthenticated Path Traversal to Full Instance Takeover in Postiz Author: Krithik Babu P @DarkLycn1976 Published: 2026-08-10 CVE: CVE-2026-19264 Severity: Critical - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory Affected:...

CyBroHttpServer-v1.0.3-Directory-Traversal

CyBroHttpServer-v1.0.3-Directory-Traversal Directory Traversal in CyBroHttpServer v1.0.3 allows an attacker to read sensitive informations. CVE-2018-16133 https://vulners.com/cve/CVE-2018-16133 PoC To exploit vulnerability, someone could use 'http://host/../../../../../../../../' request to get...

CVE-2026-107716

A flaw was found in Banks. The directory prompt registry fails to properly validate symbolic links file system shortcuts that point to another location. An attacker with the ability to influence files in the prompt directory can exploit this vulnerability by creating links that point outside the...

CVE-2026-104082

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...

zerologon

Zerologon Set of scripts, to test and exploit the zerologon vulnerability CVE-2020-1472 What is it? ZeroLogon is a vulnerability that allows us to exploit a cryptography flaw in Microsoft's Active Directory Netlogon Remote Protocol MS-NRPC, which allows users to log in to servers using NTLM...

CVE-2026-108156

LobsterAI versions 2026.5.27 through 2026.9.23 are vulnerable to an external control of file path vulnerability (CWE-73) within the skills:delete IPC handler. The application fails to validate the openclawSourceDir value provided in a skill's _meta.json file during the uninstallation process. An ...

CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

CVE-2025-68937

CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE Automated proof-of-concept for CVE-2025-68937 : directory traversal via symlink dereferencing in Gitea and Forgejo template repository processing, leading to remote code execution. Any authenticated user no admin required can obtain a shell as t...

EUVD-2026-95887

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...

WordPress Advanced Classifieds & Directory Pro plugin <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Ivaylo in WordPress Plugin Advanced Classifieds & Directory Pro versions = 3.4.4...

ResetNightmare-impacket

ResetNightmare — CVE-2026-27912 Linux / impacket tooling for CVE-2026-27912 "ResetNightmare". Resets a target Active Directory account's password by requesting a kadmin/changepw TGT for an NTENTERPRISE principal whose name is the target's sAMAccountName, using an account UPNUser on which we can...

WSOB

😭 WSOB CVE-2022-29464 😭 WSOB is a python tool created to exploit the new vulnerability on WSO2 assigned as CVE-2022-29464. CVE-2022-29464 details: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a...

GetFGPP

GetFGPP Dumps Fine Grained Password Policies FGPP from Active Directory via LDAP. Requires read access to the Password Settings Container — by default only admins have this right, but it's occasionally misconfigured. Install pip3 install ldap3 python-dateutil no longer required Usage usage: fgpp....

CVE-2026-63030-poc

This repository does not have a README...

google-dorks

google-dorks Update Jan 2026 Read this, my Medium Blog Space:👩‍💻Proviesec Security Medium Articles - read it Table of Contents Introduction My love google dork Search filters Operators Search Term OR Ideas Links Example Preventing GOOGLE DORKS Introduction ⭐ Star us on GitHub — it motivates a lot!...

Grafana-Plugin-Enumerator-CVE-2021-43798

Grafana CVE-2021-43798 Plugin Enumerator A small Bash-based tool for testing Grafana instances for CVE-2021-43798 , a directory traversal vulnerability affecting vulnerable Grafana versions. The tool enumerates Grafana plugin IDs and uses curl --path-as-is to test whether directory traversal can...

CVE-2026-31278

CVE-2026-31278 Suprema BioStar 2: Active Directory Credential Exposure Metadata Field| Details ---|--- CVE ID| CVE-2026-31278 Vendor| Suprema Inc. Product| BioStar 2 Vulnerability Type| Sensitive Information Disclosure / Credential Exposure Attack Vector| Remote / Authenticated / Low Complexity...

netscout

NetScout NetScout is an OSINT tool that finds domains, subdomains, directories, endpoints and files for a given seed URL. It consists of the following components: BinaryEdge client: Gets subdomains DNS: Attempts to perform a DNS zone transfer to extract subdomains Crawler: Gets URLs and directori...

GPOCrack

GPOCRACK.py Active Directory Group Policy Preferences cpassword cracker/decrypter. How to use python2 gpocrack.py cGc4817iMQclr1Ssixv35UpaH/FXy+1s5FnM2RqD4BI...

ffufw

ffufw ffuf with that special sauce Install go install github.com/puzzlepeaches/ffufw@latest Why? ffufw is a wrapper around ffuf to make directory bruteforcing easier and more intelligent. The tool has the following features: Multithreaded execution of ffuf commands for a list of URLs Dynamic...