CVE-2026-120210: FFmpeg: FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files…

FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence...

CVE-2026-110251: villatheme Revopic – Photo Reviews for WooCommerce: The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all…

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the deletereviewsimage function's deletecomment hook trusting attachment IDs supplied via the wcprimageuploadid POST...

CVE-2026-120208: strukturag libheif: libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in uncdecodermixedinterleave::processTile that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and 8-b...

CVE-2026-118599: GNOME Epiphany: A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompressxpithread used libarchive with archivereadsupportformatall and filters, so the installer did not require a real ZIP. A TAR file name...

CVE-2026-103882: acadlix: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to…

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the postdeleteassessmentfilebyid function in all versions up to, and including, 1.1.9. This makes it possible for...

CVE-2026-118235: wpazleen: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is…

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handleupload function. This is due to missing server-side file key allowlist and pre-sanitization...

CVE-2026-110176: Drupal File Force Download: The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a…

The File Force Download module for Drupal 7 implements hookfiledownload to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2...

CVE-2026-92294: brainstormforce Spectra Legacy – Gutenberg Blocks: The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file…

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the 'construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to...

CVE-2026-118043: Unknown Bulk Media Register: The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a…

The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls an...

Filament 5.6.4 Unauthenticated Temporary File Upload

Filament versions 3.0.0 through 3.3.51, 4.0.0 through 4.11.4, and 5.0.0 through 5.6.4 contain an unauthenticated temporary-file upload issue on authentication pages. The proof of concept uploads test files and checks retrieval paths. https://packetstorm.news/download/238694...

OpenSTAManager 2.10 Shell Upload

OpenSTAManager versions 2.10 and earlier contain an arbitrary file upload vulnerability in the module update functionality. The included proof of concept authenticates, creates a malicious module containing a PHP shell, and uploads it. https://packetstorm.news/download/238693...

Gogs 0.13.3 Symlink Arbitrary File Write

Gogs version 0.13.3 and prior contain a symlink handling flaw in the PutContents API that allows an authenticated user to overwrite files writable by the Gogs process. The supplied proof of concept demonstrates the issue. https://packetstorm.news/download/238685...

Cacti 1.2.28 Authenticated Arbitrary File Creation / Remote Code Execution

Cacti version 1.2.28 and prior contain an authenticated arbitrary file creation vulnerability in graph template handling that can lead to remote code execution. This proof of concept writes and triggers a PHP payload through crafted rrdtool graph options. https://packetstorm.news/download/238686...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

forgejo-restore-file-open

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · forgejo-restore-file-open Write-up: https://abraxaslabs.tech/research/forgejo-restore-file-open forgejo-restore-file-open Class: File read Reach: Local Forgejo 16.0.5 8d24b7d - Forgejo forgejo restore-repo of an...

CVE-2023-26255-6

Jira plugin STAGIL Navigation FileName Parameter Arbitrary File Read Vulnerability POC Script Usage as follows: Single URL Detection 1. Use the command line to detect a single URL, pass the URL parameter with -U 2. Observe the returned result; if it shows "is vulnerable!", then the vulnerability...

CVE-2024-3400

CVE-2024-3400 Simple Python code to check for arbitrary uploading to a PaloAlto Simply checks for status codes returned from the paloalto before and after file creation. This creates a randomly generated filename and attempts to call it back after post. This will save a file to your PaloAlto if...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

lighttpd-win32-dotdot-space

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lighttpd-win32-dotdot-space Write-up: https://abraxaslabs.tech/research/lighttpd-win32-dotdot-space lighttpd-win32-dotdot-space Class: File read Reach: Remote lighttpd 1.4.85 4852959 - lighttpd Native WIN32 staticfile...

CVE-2021-44228_scanner-main-Modified-

CVE-2021-44228scanner modified - Deprecated Original Script and Repo: https://github.com/CERTCC/CVE-2021-44228scanner Modified by: Alex Pena Applications that are vulnerable to the log4j CVE-2021-44228 issue may be detectable by scanning jar, war, and ear files to search for the presence of...