CVE-2026-48282-coldfusion-rds-detection

CVE-2026-48282 — Adobe ColdFusion RDS Validation and Detection Laboratory validation of CVE-2026-48282 in Adobe ColdFusion Remote Development Services RDS, focused on technical evidence, event reconstruction, and defensive detection opportunities. The repository documents a controlled test in whi...

vbox-vmdk-sparse-extent

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vbox-vmdk-sparse-extent Write-up: https://abraxaslabs.tech/research/virtualbox-7-2-20-leftovers vbox-vmdk-sparse-extent Class: File read Reach: Local host UI:R Oracle VM VirtualBox OSS 7.2.20 f2792cf44 - Oracle A host...

CVE-2026-65400

CVE-2026-65400 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

CVE-2024-22889-Plone-v6.0.9

Product: Plone CMS Version: v6.0.9 Date found: 10.01.2024. Date reported: 10.01.2024. Vulnerability type: Incorrect Access Control. CVE ID: CVE-2024-22889 Description: Due to incorect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion LFI Summary CVE-2026-12227 is a critical CVSS 9.8 unauthenticated Local File Inclusion LFI vulnerability in the Visual Composer Website Builder plugin for WordPress, affecting all versions up to and including...

helm-plugin-path-traversal-security-assessment

CVE-2026-35204 - Helm Plugin Path Traversal Arbitrary File Write Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Helm plugin path traversal risk, including technical analysis, impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

CVE-2026-96515

CVE-2026-96515: authenticated root command execution in Netlink HG323RW An authenticated limited web user can upload a shell script through the Netlink HG323RW diagnostic import handler and have the UID-0 BOA process execute it. Authentication and valid verification/CSRF values are required; this...

CVE-2026-109763

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the File Handling component...

CVE-2026-109744

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Other issue in the DOM: File component...

CVE-2025-24963

CVE-2025-24963 - Vitest Browser Mode - Local File Read ​CVE-2025-24963 is a medium-severity vulnerability CVSS 3.1 score: 5.9 affecting the @vitest/browser package, a component of the Vitest testing framework powered by Vite. This vulnerability arises from improper input validation in the...

CVE-2026-109782

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the File Handling component...

proftpd-site-copy-dest-follow

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · proftpd-site-copy-dest-follow Write-up: https://abraxaslabs.tech/research/proftpd-site-copy-dest-follow proftpd-site-copy-dest-follow Class: Privilege leftover / File write Reach: Remote ProFTPD 1.3.9d f59f248 -...

CVE-2026-36669-FengOffice

Security Advisory: CVE-2026-36669 Unauthenticated Arbitrary File Upload in Feng Office Community Edition An unauthenticated arbitrary file upload vulnerability exists in ckuploadhandler.php in Feng Office Community Edition version 3.11.13.11. This flaw allows remote, unauthenticated attackers to...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC & Reproduce This repository contains Proof-of-Concept PoC exploit code and instructions to reproduce the Local File Inclusion LFI vulnerability in MLflow, identified as CVE-2023-1177. Vulnerability Information: CVE ID: CVE-2023-1177 Vulnerability Type: Local File...

CVE-2026-3891

Pix for WooCommerce = 1.5.0 - Unauthenticated Arbitrary File Upload CVE-2026-3891 PoC 📜 Description CVE-2026-3891 is an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The plugin exposes an AJAX endpoint lknpixforwoocommercec6savesettings that...

CVE-2021-46417

CVE-2021-46417 Franklin Fueling Systems Colibri Controller Module - Local File Inclusion Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Use python3 CVE-2021-46417.py -u...

CVE-2023-39141-LFI-enumerator

Enumerate remote server files by exploiting CVE-2023-39141 See POC: https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e...

CVE-2020-23591

CVE-2020-23591 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" which allows an attacker to upload arbitrary file through "...

PoC-CVE-2026-38526

CVE-2026-38526 - Krayin CRM PHP Upload RCE Automated exploit for Krayin CRM ≤ 2.2.x. This script exploits an unrestricted file upload vulnerability in the TinyMCE endpoint /admin/tinymce/upload, bypasses MIME-type validation by spoofing image/jpeg, uploads a PHP webshell, and executes arbitrary...

CVE-2026-90847

Overview iuxset.cgi contains an authenticated remote code execution RCE vulnerability via file upload. It lives in the function that's invoked when iuxset.cgi is called with tmenu=camera and smenu=systemsetup, which maps to Camera Management → System Setup in the administrator web UI. Although it...