cve-2021-41773-lab

CVE-2021-41773 — Minimal FastAPI Lab A small, self-contained FastAPI lab demonstrating how decoding user input before validating filesystem boundaries can lead to directory traversal and local file inclusion LFI, modeled after the Apache HTTP Server issues CVE-2021-41773. Features Minimal,...

CVE-2026-106173

CVE-2026-106173 — FortiSIEM Path Traversal Vulnerability Overview This repository documents CVE-2026-106173 , a reported path traversal vulnerability affecting Fortinet FortiSIEM. Path traversal vulnerabilities occur when an application fails to properly validate file paths, potentially allowing ...

-cve-2021-46381

D-Link DAP-1620 arbitrary file read vulnerability fofa search statement: "DAP-1620" && title=="D-LINK" Use python3 DLINL.py...

NotCVE-2026-0009

Path Traversal Vulnerability in nitroshare Description NitroShare Desktop v0.3.4 contains a path traversal vulnerability in its LAN file transfer server. The server listens on all network interfaces port 40818 without authentication. When receiving files, the name field from the sender's JSON ite...

CVE-2021-3129

CVE-2021-3129 Unauthenticated RCE in Laravel Ignition via File Upload Summary of the CVE In affected versions of Laravel Ignition a attack can execute arbitrary code because of the insecure usage of filegetcontents and fileputcontents. This is only exploitable for websites that use debug mode...

CVE-2024-53617

CVE-2024-53617: Stored XSS in LibrePhotos before version 2024w47 LibrePhotos before version 2024w47 has a stored XSS Cross-site Scripting allows attackers to takeover any account via uploading an HTML file on behalf of the admin user using IDOR in file upload. References:...

CVE-2020-24955

CVE-2020-24955 SUPERAntiSpyware Professional X Trial = 10.0.1206 Local Privilege Escalation SUPERAntiSpyware Professional X Trial versions prior to 10.0.1206 are vulnerable to local privilege escalation because it allows unprivileged users to restore quarantined files to a privileged location...

CVE-2026-14361

CVE-2026-14361 Consul Template's writeToFile helper opened an operator-supplied destination directly and followed linked path components, allowing rendered output to escape the intended directory and overwrite a preexisting file. Intro I found this issue while reviewing HashiCorp Consul Template ...

CVE-2026-59310

CVE-2026-59310 More echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...

CVE-2026-27540

🌐 Language / Dil 📌 Özet WooCommerce Wholesale Lead Capture WWLC — Kimlik doğrulamasız dosya yükleme → RCE | ---|--- Ürün| WooCommerce Wholesale Lead Capture — wwlc eklentisi Sürüm| ≤ 2.0.3.1 Fixed| 2.0.3.2+ — upload handler korumalı Auth| Unauthenticated Vektör|...

CVE-2025-47550

Instantio - Wordpress Plugin 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft forever preferredlft forever 2: eth0: mtu...

CVE-2024-10449-patch

Patch for CVE-2024-10449 https://nvd.nist.gov/vuln/detail/CVE-2024-10449 Steps: Download the patched loginAction.php file from this repository https://raw.githubusercontent.com/g-u-i-d/CVE-2024-10449-patch/refs/heads/main/loginAction.php and replace the vulnerable version with this one. Edit the...

CVE-2017-0199

Exploit toolkit CVE-2017-0199 - v4.0 Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other...

CVE-2026-58073-check

Veeam Service Provider Console Agent Impersonation — Patch-State Detection Script A safe, unauthenticated detector for the KB4893 vulnerabilities in Veeam Service Provider Console published 2026-08-04. It answers one question per target, before any authentication or TLS: are the KB4893 fixes...

CVE-2023-22047-Oracle-PeopleSoft-LFI

🚀 CVE-2023-22047 - PeopleSoft LFI Exploit Unauthenticated Local File Inclusion LFI in Oracle PeopleSoft Enterprise PeopleTools 👨‍💻 Author 0xTerror Security Researcher | Exploit Developer 📋 Description CVE-2023-22047 is a critical unauthenticated Local File Inclusion LFI vulnerability discovered in...

Myesve

myesve CVE-2024-38475 Exploitation Framework – Version 1.0 Disclaimer: This tool is intended for authorized security testing, educational research, and legitimate bug bounty programs only. Do not use it against systems you do not own or lack explicit permission to test. The authors assume no...

CVE-2026-25732-NiceGUI-3.6.1

Author: Mohammed Idrees Banyamer Contact: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI Path Traversal in FileUpload → Arbitrary File Write Exploit Title: NiceGUI Path Traversal in FileUpload Leading to Arbitrary File Write Date: 2025-06-06 Tested on:...

CVE-2026-34070

I Found a Path Traversal Bug in LangChain That Could Leak Your Cloud Credentials How a forgotten legacy API in one of AI's most popular frameworks quietly exposed millions of applications to arbitrary file reads. There's a certain feeling you get when a proof-of-concept works on the first try. No...

POC-CVE-2026-19681

CVE-2026-19681 — command injection in file upload processing authenticated Status: CONFIRMED on a 6.7.2-14.el9 lab 2026-08-20. Staged filename p;sleep$IFS20;-EvvfJk via POST /rest/file/upload context prefix carries the metachars, then POST /rest/auditFile type=scapLinux, version=1.2 stalled exact...

CVE-2026-103978

CVE-2026-103978 - Unauthenticated path traversal in OPNMGR Arbitrary .json file read, no login needed. Found this while reading through the source of agit8or1/OPNMGR, an OPNsense fleet manager written in PHP. | ---|--- CVE| CVE-2026-103978 Advisory| GHSA-8x7v-vwpx-3wr7 Class| CWE-22 Path Traversa...