CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

CA Common Services privilege escalation CVE-2016-9795 revisited Description In one of my pentests, I stumbled across the casrvc SUID binary which is part of CA Common Services suite. As I found out, the binary is vulnerable to local privilege escalation. As a matter of fact, a public CVE...

CVE-2023-33977

CVE-2023-33977 Stored XSS Via SVG Upload in kiwitcms/kiwi - by M Nadeem Qazi Description This repository addresses the stored XSS vulnerability discovered in the kiwitcms/kiwi application, which was assigned the CVE-2023-33977 identifier. The vulnerability allows for the execution of malicious...

CVE-2015-4133

CVE-2015-4133 usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH wp-content/uploads sub...

CIMCown

CIMCown CVE-2026-20200 Argument Injection in Cisco IMC with RCE Christoph Peil @ NSIDE ATTACK LOGIC 2026 CVE: CVE-2026-20200 CVSS v3.1 CISCO: 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 NSIDE: 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Advisory: NSIDE-SA-2026-003 Blogpost:...

CVE-2026-119147

ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass in the modsftp copy-file extension handler that skips Limit WRITE checks for new destination files. Authenticated SFTP users can copy any readable file to a new path in write-denied directories, creating files where uploads are...

CVE-2023-50164-PoC

CVE-2023-50164 PoC This repository is a proof of concept PoC of the CVE-2023-50164 vulnerability. 1. About CVE-2023-50164 CVE-2023-50164 is a file path traversal vulnerability that occurs in Apache Struts web application. An attacker could exploit this vulnerability to upload malicious file...

CLEANSTART-2026-BH80577 launch-editor allows users to open files with line numbers in editor from Node

Security vulnerability affects the qdrant package. launch-editor allows users to open files with line numbers in editor from Node...

CLEANSTART-2026-MM86687 On Unix systems, opening a file in an os

CVE-2026-39822 affects multiple packages. On Unix systems, opening a file in an os. See references for individual vulnerability details...

CLEANSTART-2026-EG43679 On Unix platforms, when listing the contents of a directory using File

Security vulnerability affects the external-dns-fips package. On Unix platforms, when listing the contents of a directory using File...

CVE-2026-13714

Realtyna WPL 5.3.0 - Unauthenticated RCE Exploit Description This exploit targets a critical vulnerability in Realtyna Organic IDX + WPL Real Estate plugin versions prior to 5.3.0. The plugin uses hardcoded credentials and allows unauthenticated file upload leading to Remote Code Execution RCE...

CVE-2026-119720

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in readfiledna that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that, when opened, triggers the out-of-bounds rea...

CVE-2021-40905

CVE-2021-40905 - RCE via a crafted .mkp file Application: CheckMK Management Web Console Software Revision: Less than or equal to 2.0.0p17 Attack type: RCE Solution: TBD or the MKPs shared on https://exchange.checkmk.com/ are manually reviewed by CheckMk and they look for malicious code or...

CVE-2023-52076-PoC

CVE-2023-52076-PoC Proof-of-concept for CVE-2023-52076, a critical path traversal and arbitrary file write vulnerability in Atril/Xreader document viewers affecting MATE Desktop environments. The script generates a crafted EPUB payload with zip-slip paths targeting either SSH configuration or...

CVE-2026-21589

💠 CVE-2026-21589 — Atlassian Pre-Auth Arbitrary File Access Unauthenticated Arbitrary File Access via Path Traversal Security research and technical analysis of CVE-2026-21589 affecting multiple Atlassian Data Center products. Overview CVE-2026-21589 is a critical unauthenticated arbitrary file...

CVE-2017-0261

CVE-2017-0261 and Exploit Sample Analysis 0x01 Vulnerability Description Cause: When opening an Office document, FLTLDR.EXE is used to render an embedded EPS file containing the vulnerability. The file is written in PostScript language and can be exploited by an attacker through a "save-restore"...

pfsense-cp-filemanager-write

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-cp-filemanager-write pfsense-cp-filemanager-write Class: File write Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Upload name is not basename. A name that already contains captiveportal- ski...

CVE-2019-17137

CVE-2019-17137 Info CVE: https://vulners.com/cve/CVE-2019-17137 POC GET /index.htm%00currentsetting.htm HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Accept: / Accept-Language:...

CVE-2025-30208

CVE-2025-30208 Using a special raw import query string on a vite dev server, a attacker can read arbitrary files Summary of the CVE Vite dev servers before 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 can bypass the server.fs.deny file access checks for @fs requests. Appending ?raw?? or ?import&raw??...

CVE-2025-24071

CVE-2025-24071 — Windows File Explorer Spoofing / NTLM Hash Disclosure via .library-ms ⚠️ Disclaimer: This tool is intended for educational purposes and authorized penetration testing only. Use it only against systems you own or have explicit written permission to test. Unauthorized use is illegal...

CVE-2018-19422

CVE-2018-19422 Exploit Title: File Upload Bypass to RCE Authenticated Google Dork: N/A Date: 17/05/2021 Exploit Author: Drew Alleman Based on an exploit written by: Fellipe Oliveira Vendor Homepage: https://subrion.org/ Software Link: https://github.com/intelliants/subrion Version: SubrionCMS 4.2...