11114 matches found
Dify <=1.14.1 - Unauthenticated Plugin Daemon Path Traversal
Dify version 1.14.1 and prior are affected by an unauthenticated path traversal in the Plugin Daemon icon proxy endpoint. The /console/api/workspaces/current/plugin/icon endpoint requires no authentication and passes the filename query parameter unsanitized into the internal Plugin Daemon REST AP...
ESAFENET CDG - Arbitrary File Download
ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. id: CVE-2019-9632 info: name: ESAFENET CDG - Arbitrary File Download author: pdteam severity: hi...
Avid NEXIS Agent - Arbitrary File Read
Avid NEXIS E-series, F-series, PRO+, and System Director Appliance SDA+ before 2025.5.1 contain an unauthenticated arbitrary file read caused by improper validation of the filename parameter, letting unauthenticated attackers read sensitive files, exploit requires no authentication. id:...
CVE-2026-5027
This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...
CVE-2026-25732-NiceGUI-3.6.1
Author: Mohammed Idrees Banyamer Contact: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI Path Traversal in FileUpload → Arbitrary File Write Exploit Title: NiceGUI Path Traversal in FileUpload Leading to Arbitrary File Write Date: 2025-06-06 Tested on:...
CVE-2026-25548
CVE-2026-25548 — Remote Code Execution in InvoicePlane 1.7.0 Vulnerability: Remote Code Execution via Local File Inclusion + Log Poisoning Product: InvoicePlane Affected Version: 1.7.0 and likely prior versions Severity: Critical CVSS 3.1 Score: 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CW...
cve-2026-21440-writeup-poc
cve-2026-21440 path traversal to arbitrary file write in @adonisjs/bodyparser overview a critical path traversal vulnerability exists in the @adonisjs/bodyparser package that allows remote attackers to write arbitrary files outside the intended upload directory. when the multipartfile.move functi...
Exploit-CVE-2026-1357
Install dependencies pip3 install pycryptodome requests Basic exploit python3 wpvivi.py http://target.com Custom webshell python3 wpvivi.py http://target.com --shell backdoor.php python3 wpvivi.py http://target.com --code "" Technical explanation: Null Byte Key: When RSA decryption fails, it...
CVE-2026-23907
Apache PDFBox Path Traversal Vulnerability Vulnerability Summary Description Apache PDFBox's ExtractEmbeddedFiles example code does not sanitize filenames when extracting embedded files from PDFs. An attacker can embed files with path traversal sequences ../ to write files to arbitrary filesystem...
detect-ransomware-filenames
Detect Ransomware Filenames This package/script watches SMB transactions to look for known bad filenames that ransomware is known to use. It rides on top of the Anti-Ransomware File System Resource Manager Lists maintained here. How to use A Python script download-list.py is included to be able t...
CVE-2025-60787-Detection-motionEye-RCE-via-Config-Injection
README.md CVE-2025-60787 Detection: motionEye RCE via Config Injection Unauthenticated Remote Code Execution in motionEye Still Images - Image File Name Example PoC payload: $touch /tmp/test.%Y-%m-%d-%H-%M-%S When motion restarts, the shell command executes and creates /tmp/test. Detection Covera...
CVE-2024-53677
POC from https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/ RCE Conditions No restriction on dangerous file extensions File name obtained from upload parameters when uploading files...
CVE-2025-65754
CVE-2025-65754: XSS almacenado en Algernon 1.17.4 Descripción Algernon v1.17.4 está afectado por una vulnerabilidad de Cross-Site Scripting XSS que permite a los atacantes ejecutar código arbitrario mediante un payload manipulado en un nombre de archivo. Proyecto afectado: Algernon - 1.17.4...
cve-2020-27358-27359
CVE-2020-27358 / CVE-2020-27359 Exploitation steps for CVE-2020-27358 and CVE-2020-27359 CVE-2020-27358 An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature that allows users to export their conversation threads as CSV allows non-privileged users to export o...
gin-vulnerable
gin-vulnerable Consumidor de demostración fijado en github.com/gin-gonic/gin v1.7.0 vulnerable a CVE-2023-29401. El manejador /download/:filename pasa la entrada del usuario directamente a Context.FileAttachment — el patrón de condición de explotación que Endor marca como explotable...
POC_CVE-2024-10829
POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...
CVE-2026-46571
A flaw was found in ntfs-3g. This vulnerability allows an attacker to read sensitive data from process memory, resulting in information disclosure, by supplying a maliciously crafted NTFS filesystem image. When the system attempts to inspect a corrupted file within the image, an out-of-bounds rea...
POC_CVE-2024-36420
POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...
AZL-106682 CVE-2026-106587 affecting package openssh 9.8p1-10
In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled...