CVE-2023-2825

CVE-2023-2825 On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition CE and Enterprise Edition EE version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug...

CVE-2024-23897

CVE-2024-23897 Jenkins RCE Arbitrary File Read CVE-2024-23897 Usage: python poc.py http://127.0.0.1:8888/ /etc/passwd Update: Update to Jenkins 2.442, LTS 2.426.3 Fix: If you can't update to the latest version, disable access to the CLI, this should completely eliminate the possibility of...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification vulnerability

Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification vulnerability discovered by AlexHenry in WordPress Plugin Spectra versions = 2.20.4...

CVE-2026-119343 Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...

CVE-2026-119343 Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...

CVE-2026-119343

Stirling-PDF versions prior to 3.0.0 are vulnerable to Server-Side Request Forgery (SSRF) and local file read due to missing HTML sanitization. The POST /api/v1/ai/tools/create-pdf-from-html-agent endpoint accepts attacker-controlled htmlContent and passes it directly to WeasyPrint without using ...

CVE-2026-38526

CVE-2026-38526 — Krayin CRM ≤ 2.2.x Authenticated RCE ⚠️ Legal disclaimer : this code is provided for educational purposes and for authorized testing only CTF, bug bounty, private lab. The author is not responsible for any illegal use. Description Krayin CRM Webkul ≤ 2.2.x exposes the...

CVE-2025-57231

CVE-2025-57231 - Docmost 0.22.0 - Arbitrary File Read This repo contains a Proof of ConceptPoC exploit for CVE-2025-57231. Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permission to tes...

CVE-2026-119342 Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses...

CVE-2026-119342

The Stirling-PDF web application (versions 2.13.1 through 2.13.2 ) is vulnerable to a local file read (LFI) via the POST /api/v1/convert/svg/pdf endpoint. The root cause is a same-origin bypass where a scheme-less root-relative image reference evades SvgSanitizer.isExternalUrl() checks. This allo...

EUVD-2026-114456

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses...

CVE-2026-119342 Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses...

ES-File-Explorer-Open-Port-Vulnerability---CVE-2019-6447

This repository does not have a README...

LovelySn0w

LovelySn0w. a iOS CVE-2018-4150 Application example. if this doesn't compile in XCode please message me on twitter. it's probably my fault then! it's not completetd at the moment. if you find //ACPV ›Some version ... you are here from the PS4-Scene, waiting for me to finish my work on the PS4...

CVE-2024-2961-XXE-Exploit

CVE-2024-2961 CNEXT XXE Channel Adaptation Exploit Script Adapts the PHP file-read - RCE exploit script from Ambionics' official cnext-exploits to the SVG upload + XXE arbitrary file read scenario PolarisCTF 2026 "Avatar Uploader" type challenges. Prerequisites Target: Linux + glibc update...

CVE-2021-33564

CVE-2021-33564 PoC Exploit script for CVE-2021-33564 Argument Injection in Dragonfly Ruby Gem. Usage Arbitrary File Read python3 poc.py -u https:///system/refinery/images -r /etc/passwd Arbitrary File Write python3 poc.py -u https:///system/refinery/images -w public/test.txt -c test.txt -lu http:...

CVE-2026-17106

CVE-2026-17106 — CopyEscape:docker cp container-to-host arbitrary file write HackSpeak distribution mirror. This repository is a distribution mirror of the CopyEscape PoC CVE-2026-17106 published by the Imperva Red Team Ron Masas , with the code identical to upstream; upstream does not include a...

CVE-2026-119336

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory...

CVE-2026-119334

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a...

CVE-2026-119328

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immichml/main.py accepted an options object and passed its values into model construction in...