Sangfor NGAF - loadfile.php File Read

Reads arbitrary files via Sangfor Next Gen Application Firewall /svpnhtml/loadfile.php file parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor NGAF loadfile.php arbitrary file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Webp Server Go - Path Traversal File Read

Reads arbitrary files via path traversal in Webp Server Go github.com/webp-sh/webpservergo. !/usr/bin/env python3 -- coding: utf-8 -- """Webp Server Go path traversal file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

Elastix - graph.php File Read

Reads arbitrary files via Elastix vtigercrm/graph.php currentlanguage LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php currentlanguage file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

EverFocus - Path Traversal File Read

Reads arbitrary files via EverFocus directory traversal using /../../../../../../ style paths. !/usr/bin/env python3 -- coding: utf-8 -- """EverFocus DVR/camera directory traversal file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.l...

Honeywell IP Camera - check.cgi File Read

Reads arbitrary files via Honeywell IP camera /check.cgi?file= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP camera check.cgi file parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

Sangfor Application - download.php File Read

Reads arbitrary files via Sangfor Application /report/download.php?pdf= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor Application download.php pdf parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

WedgeOS - ssgimages File Read

Reads arbitrary files via WedgeOS = 4.0.4 /ssgmanager/ssgimages?name= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """WedgeOS ssgimages name parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853

The Pods WordPress plugin (versions before 3.3.9.2 ) is vulnerable to an arbitrary file read vulnerability. The root cause is that the plugin fails to restrict which functions a display callback can resolve to. This allows users with the author role or higher to read arbitrary files from the serv...

Exploit for CVE-2020-1938

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — pyt...

Exploit for CVE-2020-1938

CVE-2020-1938 Tomcat File Read / File Include Ghostcat — pyt...

CVE-2026-75164

The MBS-Solutions X-Serie Gateway is affected by an arbitrary file read vulnerability in the /cgi-bin/ugwdownload.cgi component of firmware version V6_00_05 . A remote authenticated user with a low-privileged Standard role can exploit this by using the file query string parameter to retrieve arbi...

PT-2026-85483

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2 Description A path traversal issue exists in the file-read endpoint accessible to users with the reader role. The system follows symbolic links symlinks when opening authorized asset paths under data/assets/. Thi...

CVE-2026-85665: Improper Limitation of a Pathname to a Restricted Directory

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

CVE-2026-85618: Improper Limitation of a Pathname to a Restricted Directory

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

CVE-2026-74235: Improper Limitation of a Pathname to a Restricted Directory

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcfhandledownload function accepts parameters prefixed with vdel and appends their values directly to the base configuration directory path without...

CVE-2026-74853: Files or Directories Accessible to External Parties

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

PT-2026-85542

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing inputpath or verbatiminputpath directives to have the TeX engine read...