491447 matches found
CVE-2024-9932
CVE-2024-9932 Wux Blog Editor = 3.0.0 - Unauthenticated Arbitrary File Upload Description: The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbtinsertImageNew' function in versions up to, and including, 3.0.0. This...
EUVD-2026-114841
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2026-120307
The Beta9 worker is vulnerable to a container escape because the sandbox file API serves paths from outside the container. The root cause lies in the getHostPathFromContainerPath function, which incorrectly joins paths using filepath.Join after a prefix check. This allows an attacker to use a lon...
CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2026-120307 Beta9 container escape via unvalidated sandbox file paths
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that...
CVE-2022-44268-PoC
CVE-2022-44268-PoC This repository includes a test file for CVE-2022-44268 ImageMagick Arbitrary File Read. Testing 1. Upload the pngout.png into a Webapplication 2. Check if the image can be cropped, cut or edited in any way 3. Download the edited image 4. Use identify -verbose editimage.png to...
CVE-2026-9535
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk versions: 9.6.1. A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability...
Exploit for CVE-2026-63765
CVE-2026-63765 β Chatwoot Proof of Concept for an authent...
CVE-2026-119375
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr return sta...
CVE-2026-120210
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence...
solr_exploit
Disclaimer The vulnerability detection methods, files, and other content provided here are strictly for use by security professionals who have obtained legal authorization, with the purpose of detecting the security of authorized servers. Security professionals must comply with legal regulations...
CVE-2021-29447
WordPress XXE Vulnerability : CVE-2021-29447 A user with the ability to upload a malicious WAVE file like an Author can exploit an XML parsing issue in the Media Library in WordPress leading to XXE attacks and that could lead to file system disclosure Vulnerable code XML External Entity XXE...
CVE-2018-4878
Metasploit module for CVE-2018-4878 The SWF file is based on the PoC by Michael Gorelik. Copy CVE-2018-4878.swf to data/exploits...
Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)
The Kitty graphics protocol handler in rio-vt builds a filesystem path from an attacker-controlled APC escape sequence and, for the temp-file medium, only checks that the path contains the substring "tty-graphics-protocol" before it opens, reads, and removefiles it. There is no .. rejection and n...
RUSTSEC-2026-0430 Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)
The Kitty graphics protocol handler in rio-vt builds a filesystem path from an attacker-controlled APC escape sequence and, for the temp-file medium, only checks that the path contains the substring "tty-graphics-protocol" before it opens, reads, and removefiles it. There is no .. rejection and n...
CVE-2022-0847
Information Exploit Title: Local Privilege Escalation in Linux kernel CVE-2022-0847 Date: 03/07/2022 Exploit Author: Max Kellermann Tested on: ubuntu 20.04.1 LTS Affect product:Linux kernel 5.8 or later Fixed Product:Linux kernel 5.16.11, 5.15.25, 5.10.102 CVE ID: CVE-2022-0847 How to Exploit Tes...
CVE-2025-2294
CVE-2025-2294 π¨ CVE-2025-2294 - Local File Inclusion LFI Vulnerability in Kubio AI Page Builder for WordPress 𧱠π Overview CVE-2025-2294 is a critical π₯ Local File Inclusion LFI vulnerability affecting the Kubio AI Page Builder plugin for WordPress versions up to and including 2.5.1. This flaw...
CVE-2019-12086
Documentation CVE-2019-12086 jackson unserialize Vulnerability Exploitation 1. Start a malicious MySQL server: python roguemysqlserver.py 2. Check mysql.log in the same directory: tail -f mysql.log 3. Send the following JSON to the vulnerable application:...
lnkbomb
Lnkbomb Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder or smbserver to gather...