webuploader-0.1.15-Demo

Le composant webuploader-v-0.1.15 présente une vulnérabilité de téléversement de fichiers non authentifiée Description : Le composant Baidu WebUploader présente une vulnérabilité de téléversement de fichiers. Cette vulnérabilité est due au filtrage insuffisant des types de fichiers ou des...

CVE-2023-38831

استغلال CVE-2023-38831 - مولد أرشيف الطعم والتبديل نظرة عامة تم تصميم هذا السكربت بلغة بايثون لإنشاء ملف أرشيف "طعم وتبديل". وهو مخصص للأغراض التعليمية والاختراق الأخلاقي فقط. يرجى التأكد من حصولك على الأذونات اللازمة قبل استخدام هذا السكربت. أرشيف "الطعم والتبديل" هو أرشيف يحتوي على نسختين...

Lightdash version <= 0.510.3 Arbitrary File Read

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension .csv or .png is used. id: CVE-2023-35844 info: name: Lightdash version = 0.510.3 Arbitrary File Read author: dwisiswant0...

CVE-2024-39929

Exim CVE-2024-39929 취약점 PoC 이 리포지토리는 Exim 취약점 CVE-2024-39929를 악용하기 위한 PoCProof-of-Concept 스크립트를 포함합니다. 이 취약점은 Exim 4.98 이전 버전에 영향을 미치며, 공격자가 파일 확장자 차단 메커니즘을 우회하여 사용자 사서함에 실행 가능한 첨부 파일을 전달할 수 있도록 합니다. 설명 이 리포지토리의 PoC 스크립트는 외부 파일에서 SMTP 서버 목록을 읽고 CVE-2024-39929를 악용하도록 제작된 첨부 파일이 포함된 이메일을 전송합니다. 스크립...

CVE-2023-38831-KQL

CVE-2023-38831 - Vulnerabilidade de Spoofing de Extensão de Arquivo no WinRAR Descrição Cibercriminosos exploraram uma vulnerabilidade que permite falsificar extensões de arquivo. Isso significa que eles podem ocultar a inicialização de scripts maliciosos em arquivos, fingindo ser tipos de arquiv...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

dnssearch

dnssearch This software is a subdomain enumeration tool. Purpose dnssearch takes an input domain -domain parameter and a wordlist -wordlist parameter , it will then perform concurrent DNS requests using the lines of the wordlist as sub domains eventually bruteforcing every sub domain available on...

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file validation mechanisms. An attacker can use this endpoint to upload malicious files into the file system that will propagate in future attacks. Compromise Chain: Unauthenticated to Full...

EUVD-2026-57264

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-14553

The zportals WordPress plugin before 6.3.4 does not properly validate uploaded files, trusting the client-supplied content type and preserving the original file extension, allowing any authenticated user Subscriber or higher to upload arbitrary PHP files and achieve remote code execution...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

CVE-2026-53593 FreeScout Vulnerable to Authenticated Remote Code Execution via incomplete upload extension denylist (.pht) — bypass of CVE-2025-48471

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads Helper::$restrictedextensions is incomplete: it does not cover the .pht extension. The authenticated upload endpoint POST /uploads/uplo...

CVE-2026-48062

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

CVE-2025-45870

LogicalDOC Enterprise (up to v9.1.1) is reported vulnerable to Local File Inclusion via the OnlyOfficeEditor servlet, where authenticated users can exploit a path traversal flaw in the fileExt parameter to access files outside designated directories. The available documents consistently describe ...

EUVD-2025-210478

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...

PYSEC-2026-2748 Open WebUI has stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

Summary The audio transcription upload endpoint takes the file extension from the user-supplied filename and saves the file under CACHEDIR/audio/transcriptions/.. The /cache/path route serves these files via FileResponse, which sets Content-Type from the on-disk extension and emits no...

CVE-2026-58143

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes...