ctf-writeups

🏴 CTF Writeups & PoC Collection Documented solutions from Hac...

CVE-2026-18682 OpenAkita File Upload API upload cross site scripting

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-18682

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-41447

FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files x86\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration...

CVE-2026-18647

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

CVE-2026-69245 Guzzle: Noncanonical cookie domain keeps subdomain scope

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

CVE-2026-18738

Shlink 5.0.0–5.1.5 is affected by a CSV formula injection via visit export (CLI). An unauthenticated attacker can send a single request with malicious values in headers (User-Agent, Referer, or request path) that start with =, +, -, or @, causing embedded DDE/WEBSERVICE payloads in CSV cells. Whe...

CVE-2026-18647 jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

EUVD-2026-52435

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

CVE-2026-18647 jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

CVE-2026-18647

The CVE concerns jina-ai reader (up to 1574bfd3…) with a flaw in isValidTLD in the Crawler/Puppeteer component (file backend/functions/src/cloud-functions/crawler.ts) that enables server-side request forgery. Remote exploitation is possible and the exploit has been publicly disclosed. Description...

CVE-2026-18645 danpros HTMLy Admin Content Endpoint admin.php add_content path traversal

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function addcontent of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. Th...

CVE-2026-18644 danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal

A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component Delete Username Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit is...

CVE-2026-18644

The vulnerability CVE-2026-18644 affects danpros HTMLy up to version 3.1.1. It targets the function unlink in the file /system/htmly.php of the Delete Username Endpoint, enabling path traversal through the File argument. The issue can be exploited remotely, and a public exploit exists. The vendor...

EUVD-2026-52412

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

CVE-2026-18632 langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

PEASS-ng v20260803-00785084

PEASS-ng - Privilege Escalation Awesome Scripts SUITE new generation Linux Privesc official course to master LinPEAS Checkhttps://hacktricks-training.com/courses/lhe/ to learn tens of linux privesc techniques and master LinPEAS Basic Tutorial Here you will find privilege escalation tools for...

EUVD-2026-52414

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

CVE-2026-18616

GL-iNet GL-MT3000 devices (≤ v4.4.5) are affected by a command injection in the wg-server.so Native Plugin, specifically the server.set_peer function in /cgi-bin/glc. The vulnerability stems from improper handling of the public_key argument, enabling remote code execution. Exploitation is possibl...

CVE-2026-18610 NewType WebEIP EIP_Com_FileList.aspx improper authentication

A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIPComFileList.aspx. The manipulation results in improper authentication. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early abo...