CVE-2022-0847-DirtyPipe-Exploits

CVE-2022-0847-DirtyPipe-Exploits A collection of exploits and documentation for penetration testers and red teamers that can be used to aid the exploitation of the Linux Dirty Pipe vulnerability. About The Vulnerability Dirty Pipe CVE-2022-0847 is a local privilege escalation vulnerability in the...

CVE-2026-27641-Flask-Reuploaded

CVE-2026-27641 is a critical security vulnerability affecting versions of the Flask-Reuploaded library. It allows remote attackers to achieve arbitrary file writes Versions affected: 1.5.0 To test the vulnerability: python3 -m venv flaskreuploadedvenv In flaskreuploadedvenv: pip install...

CVE-2023-38831

CVE-2023-38831 A POC demo on CVE-2023-38831 Brief description of vulnerability CVE-2023-38831 is a software vulnerability. The software that was exploited is WinRAR, which is used widely by almost everyone. It is a software that helps different documents or files to make it into small archives zi...

CVE-2026-74239

CVE-2026-74239: Windows path traversal in style archive import XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows. What happens The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or...

CVE-2024-57785

CVE-2024-57785 Exploit Title: Authenticated File Inclusion Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57785 Usage: CVE-2024-57785.py -h -u URL -f FILE optional arguments: -h, --help...

CVE-2026-18351

CVE-2026-18351 Mass exploit tool for CVE-2026-18351 — Unauthenticated Arbitrary File Upload → RCE in Drag and Drop File Upload for Elementor Forms credit johenlastgen | telegram @johenlastgen | channel @jlgnetworkredirect Features Passive vulnerability probe no upload Full exploit mode with shell...

CVE-2026-1405

CVE-2026-1405 Slider Future = 1.0.5 - Unauthenticated Arbitrary File Upload 🚀 CVE-2026-1405.py — Slider Future Mass Exploit Tool 🩸 Vulnerability Overview Component: Slider Future WordPress plugin Affected Versions: ≤ 1.0.5 Vulnerability: Unauthenticated Arbitrary File Upload CVE: CVE-2026-1405 CV...

CLEANSTART-2024-II02800 code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type ...

CVE-2020-15658 affects multiple packages. The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. See...

CLEANSTART-2024-FL99345 By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open r...

CVE-2020-15677 affects multiple packages. By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site the one suffering from the open redirect rather than the site the file was actually download...

CLEANSTART-2024-LG98831 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

Security vulnerability affects the firefox package. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins...

CLEANSTART-2024-EC89121 If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with a...

CVE-2020-35112 affects multiple packages. If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension such as. See references for...

CLEANSTART-2024-PD27863 ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory

Security vulnerability affects the firefox package. An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory...

CLEANSTART-2024-LN74064 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

Security vulnerability affects the firefox package. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins...

CLEANSTART-2024-XI37617 executable file warning was not presented when downloading

CVE-2021-38510 affects multiple packages. The executable file warning was not presented when downloading. See references for individual vulnerability details...

CVE-2026-62121

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

CVE-2026-61586

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or...

CVE-2026-119117

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...

CVE-2026-115604

Subscriber Arbitrary File Deletion in SureDash = 1.12.3 versions...

CLEANSTART-2024-TW25811 When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox wo...

CVE-2022-26387 affects multiple packages. When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. See references for individual...

CLEANSTART-2024-JQ80693 sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible

Security vulnerability affects the firefox package. The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible...