CVE-2025-2294

Kubio Page Builder LFI Exploit CVE-2025-2294 Local File Inclusion LFI exploit for Kubio Page Builder WordPress plugin versions ≤ 2.5.1. 📌 Description This tool exploits an unauthenticated LFI vulnerability in Kubio Page Builder plugin CVE-2025-2294, allowing attackers to read sensitive files on...

CVE-2026-21436

CVE-2026-21436 eopkg = 4.3.4, the Solus OS package manager, writes files containing absolute paths in package contents directly to the specified directory during the installation of packages with the .eopkg extension. Even if the --destdir parameter, used to install the package to a specific...

CVE-2023-4863

CVE-2023-4863 checkout webp git clone https://chromium.googlesource.com/webm/libwebp/ webptest cd webptest/ checkout vulnerable version git checkout 7ba44f80f3b94fc0138db159afea770ef06532a0 enable AddressSanitizer sed -i 's/^EXTRAFLAGS=./& -fsanitize=address/' makefile.unix build webp make -f...

cups-2.4.16-lpe

CUPS 2.4.16 — Local Privilege Escalation CVE-2026-34990 📋 Summary CUPS 2.4.16 contains a local privilege escalation vulnerability also tracked as GHSA-c54j-2vqw-wpwp. The Vulnerability 1. World-writable socket — /run/cups/cups.sock is world-writable, allowing any local user to send IPP requests t...

CVE-2021-46365

CVE-2021-46365: Unsafe XML Parsing in Magnolia CMS An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute XML External Entity attacks via a crafted XLF file. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Requirements...

CVE-2026-87902-PoC-pwnVader

CVE-2026-87902 — Unauthenticated local file inclusion in WordPress core page-template resolution → RCE Author: pwnVader · License: MIT repository root | ---|--- Component| WordPress core wp-includes/template.php Type| CWE-98 — PHP file inclusion LFI → RCE Affected| WordPress 7.1.2 7.0 branch fixe...

CVE-2024-53677-Exploitation

CVE-2024-53677 Exploitation Apache Struts RCE via File Upload Description CVE-2024-53677 is a vulnerability which impacts Apache Struts from 2.0.0 before 6.4.0. ⚠️ This was exploited in a Hack The Box lab. File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params...

CVE-2019-17662

CVE-2019-17662 Golang implementation of CVE-2019-17662 TinyVNC Arbitrary File Read leading to Authentication Bypass Exploit Copy of MuirlandOracle's python script...

CVE-2021-21402

CVE-2021-21402 CVE-2021-21402 Jellyfin arbitrary file read Wker script, batchable. The logic is very simple, it checks for the existence of win.ini via GET: define payload = /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ define info = CVE-2021-21402 Jellyfin任意文件读取 functi...

CVE-2026-110176

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

EUVD-2026-114570

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

CVE-2026-110176 File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

CVE-2026-110176 File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

CVE-2026-110176

The File Force Download module for Drupal 7 (versions 7.1.0 through 7.1.2) contains an access bypass vulnerability. The module implements hook_file_download() to add a Content-Disposition header when the download=1 query parameter is present. However, it fails to perform access checks for schemes...

Fedora 45 : gnome-shell-extension-gsconnect (2026-508badc038)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-508badc038 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...

PT-2026-134426

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls an...

PT-2026-134258

Name of the Vulnerable Software and Affected Versions File Force Download module for Drupal 7 versions 7.1.0 through 7.1.2 Description The module implements the hook file download function to add a Content-Disposition header when a file URL contains the download query parameter. In Drupal 7,...

Linux Distros Unpatched Vulnerability : CVE-2026-97209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file...

Linux Distros Unpatched Vulnerability : CVE-2026-9536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk versions: 9.6.1. A specially crafted .wind...

Linux Distros Unpatched Vulnerability : CVE-2026-119719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow...