CVE-2024-57785

CVE-2024-57785 Exploit Title: Authenticated File Inclusion Vulnerability on Zenitel AlphaWeb XE Version 11.2.3.10 Date: 08/02/2025 Exploit Author: Safvan Parakkal Vendor Website: https://www.zenitel.com/ CVE: CVE-2024-57785 Usage: CVE-2024-57785.py -h -u URL -f FILE optional arguments: -h, --help...

CVE-2026-18351

CVE-2026-18351 Mass exploit tool for CVE-2026-18351 — Unauthenticated Arbitrary File Upload → RCE in Drag and Drop File Upload for Elementor Forms credit johenlastgen | telegram @johenlastgen | channel @jlgnetworkredirect Features Passive vulnerability probe no upload Full exploit mode with shell...

CVE-2026-1405

CVE-2026-1405 Slider Future = 1.0.5 - Unauthenticated Arbitrary File Upload 🚀 CVE-2026-1405.py — Slider Future Mass Exploit Tool 🩸 Vulnerability Overview Component: Slider Future WordPress plugin Affected Versions: ≤ 1.0.5 Vulnerability: Unauthenticated Arbitrary File Upload CVE: CVE-2026-1405 CV...

CLEANSTART-2024-II02800 code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type ...

CVE-2020-15658 affects multiple packages. The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. See...

CLEANSTART-2024-FL99345 By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open r...

CVE-2020-15677 affects multiple packages. By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site the one suffering from the open redirect rather than the site the file was actually download...

CLEANSTART-2024-LG98831 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

Security vulnerability affects the firefox package. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins...

CLEANSTART-2024-EC89121 If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with a...

CVE-2020-35112 affects multiple packages. If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension such as. See references for...

CLEANSTART-2024-PD27863 ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory

Security vulnerability affects the firefox package. An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory...

CLEANSTART-2024-LN74064 When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins

Security vulnerability affects the firefox package. When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins...

CLEANSTART-2024-XI37617 executable file warning was not presented when downloading

CVE-2021-38510 affects multiple packages. The executable file warning was not presented when downloading. See references for individual vulnerability details...

CVE-2026-62121

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited...

CVE-2026-61586

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or...

CVE-2026-119117

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...

CVE-2026-115604

Subscriber Arbitrary File Deletion in SureDash = 1.12.3 versions...

CLEANSTART-2024-TW25811 When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox wo...

CVE-2022-26387 affects multiple packages. When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. See references for individual...

CLEANSTART-2024-JQ80693 sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible

Security vulnerability affects the firefox package. The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitrary File Overwrite Vulnerability...

CLEANSTART-2024-GR06833 When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% o...

CVE-2022-31739 affects multiple packages. When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%. See references for individual vulnerability...

CVE-2022-25581

CVE-2022-25581 Can't find it anywhere on the web, leaving a backup, Python exploit script , used to automate the following steps: ✅ Script Functionality Objectives 1. Log in to the backend obtain csrf and token 2. Construct a malicious request packet to upload a compressed archive containing a...

CVE-2024-57428

CVE-2024-57428 A stored cross-site scripting XSS vulnerability in PHPJabbers Cinema Booking System v2.0 exists due to unsanitized input in file upload fields eventimg, seatmaps and seat number configurations numbernewX in pjActionCreate. Attackers can inject persistent JavaScript, leading to...