Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing...

CVE-2026-15019

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-15019

Direct Download for WooCommerce (WordPress plugin) is vulnerable to directory traversal via the file_id path segment in the top-level include function, affecting all versions up to and including 1.19 . The root cause is that the product ownership check only verifies that some free, virtual, downl...

CVE-2026-15019 Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

EUVD-2026-75243

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-40003

CVE-2026-40003，又名 Joselito，是在 ZXIC/Sanechips ZX297520V3 SoC BootROM 中发现的一个任意内存写入漏洞。 !CAUTION 此 PoC 仅用于研究目的发布。您不得 将此漏洞利用用于任何恶意目的。请勿 在您不拥有的设备上或未经所有者明确同意的情况下使用此漏洞利用。 状态 自 2026 年 3 月起，该漏洞应在较新的 SoC 修订版中得到修复。目前尚无已知产品使用已修补的芯片。所有现有设备均存在漏洞。 它是如何工作的？ TL;DR：查看loader 代码。 BootROM 从 0x4 地址开始，堆栈指针位于...

poc-cve-2026-32255

Kan 附件下载 SSRF 漏洞（CVE-2026-32255）- 概念验证 本仓库包含针对 CVE-2026-32255 的概念验证（POC），这是开源项目管理工具 Kan 中存在的一个高严重性服务端请求伪造（SSRF）漏洞。 该漏洞端点允许未认证攻击者从服务器发起任意 HTTP 请求并读取完整响应，从而能够访问内部服务和云元数据端点。 目录 1. 漏洞详情 2. 运行 POC 3. 使用漏洞利用脚本 4. 如何修复漏洞 5. 免责声明 漏洞详情 CVE 信息 CVE ID ：CVE-2026-32255 受影响版本 ：Kan .env 'EOF'...

CVE-2024-55457-PoC

CVE-2024-55457-PoC MasterSAM Star Gate v11 存在目录遍历漏洞，可通过端点 /adama/adama/downloadService 进行利用。攻击者可通过操纵 file 参数访问服务器上的任意文件，可能导致敏感信息泄露。 在“故障排除 - 下载日志”功能中负责下载日志的 API 中，应用程序未对通过 file 参数指定的文件执行路径验证。此外，用户无需身份验证即可调用此 API。 GET /adama/adama/downloadService?type=&file= HTTP/1.1...

CVE-2026-27944

CVE-2026-27944 POC：Nginx UI 未授权备份下载与仪表盘访问 本仓库包含针对 CVE-2026-27944 的增强型概念验证（POC）漏洞利用代码，该漏洞是 Nginx UI 中的一个严重漏洞。 该漏洞允许未授权攻击者通过 /api/backup 端点下载系统备份。此外，应用程序会在 X-Backup-Security HTTP 响应头中泄露 AES-256 加密密钥和 IV，使攻击者能够轻松解密下载的备份。 该增强型 POC 自动化了完整的攻击链：下载备份、解密其内容、提取配置机密（如 Node Secret 和 JWT...

PT-2026-89262

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

EUVD-2026-74826

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command executi...

CVE-2026-79963

Dell Secure Connect Gateway 5.0 (SCG) is affected by a Download of Code Without Integrity Check vulnerability. The issue affects Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 . An unauthenticated attacker with remote network access could exploit this to achie...

CVE-2026-79963

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command executi...

EUVD-2026-74725

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

CVE-2026-81021

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers...

WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by dodoh4t in WordPress Plugin Youzify versions = 1.3.7...

Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download

Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/downloadworkdirfile.py, letting attackers access unauthorized files, exploit requires crafted request. id: CVE-2025-55523 info: name: Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download author: 0xAkoko...

CVE-2026-62654

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This...

CVE-2026-78254

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...