ZeroShell - kerbynet File Read

Reads arbitrary files via ZeroShell kerbynet NoAuthREQ Render Object traversal. !/usr/bin/env python3 -- coding: utf-8 -- """ZeroShell kerbynet file read / command via LFI chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

ActiveMQ - fileserver Path Traversal Detection (CVE-2015-1830)

Detects CVE-2015-1830 by requesting /fileserver/......\windows/win.ini style paths on ActiveMQ fileserver. !/usr/bin/env python3 -- coding: utf-8 -- """Apache ActiveMQ fileserver Windows path traversal CVE-2015-1830.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Emby Server - swagger-ui Path Traversal Detection

Detects Emby Server =3.2.5 directory traversal via encoded /emby/swagger-ui/../../../../etc/passwd path. !/usr/bin/env python3 -- coding: utf-8 -- """Emby Server swagger-ui path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

PROMOTIC SCADA - Directory Traversal Detection (CVE-2011-4518)

Detects CVE-2011-4518 via /webdir/../../../../../../../../windows/win.ini. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4518 via /webdir/.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Miele PST10 - Directory Traversal Detection (CVE-2017-7240)

Detects CVE-2017-7240 on Miele PST10 WebServer by requesting /../../../../../../../../etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 PST10 directory traversal CVE-2017-7240.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Apache HTTP Server 2.4.49 - Path Traversal / RCE Detection (CVE-2021-41773)

Detects CVE-2021-41773 by reading /etc/passwd via encoded /.%%2e/ traversal under /cgi-bin or /icons, and optionally confirming CGI RCE via POST to bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 path traversal / CGI RCE CVE-2021-41773.""" import re from kittysploit...

CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

CVE-2026-17540

The Bit File Manager WordPress plugin (versions

PT-2026-69915

Name of the Vulnerable Software and Affected Versions Hugging Face Accelerate versions prior to 1.15.0 Description A path traversal issue exists in the load checkpoint in model and load checkpoint and dispatch functions. These functions do not properly sanitize weight map entries within sharded...

PT-2026-69973

Name of the Vulnerable Software and Affected Versions Firecrawl versions prior to 2.11.32 Description An arbitrary file read and Server-Side Request Forgery SSRF issue exists in the extraction functionality. The problem stems from unsafe schema dereferencing of user-supplied JSON schemas in the...

CVE-2026-72904: Improper Neutralization of Special Elements used in a Command

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in...

NGINX Agent config_dirs Unauthorized Access

The vulnerability of the configdirs directive in the NGINX Agent and the NGINX Instance Manager automation platform is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to read and write arbitrary...

PT-2026-69456

Name of the Vulnerable Software and Affected Versions o1lab/xmysql affected versions not specified Description An unauthenticated remote attacker can read and download arbitrary files from the server. The issue occurs in the lib/xapi.js file where the req.query.name parameter is used in...

CVE-2026-72572: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...

CVE-2026-70622: Improper Link Resolution Before File Access

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

PT-2026-81153

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An incomplete denylist in the unsafe git revision options guard fails to include the --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the...

CVE-2026-71964: Improper Link Resolution Before File Access

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

PT-2026-69480

Name of the Vulnerable Software and Affected Versions Jenkins Project Jenkins versions prior to LTS 2.555.3 Description An incomplete patch allows an authenticated remote attacker with Item/Configure permission to read arbitrary files on the Jenkins controller filesystem. The issue exists because...

CVE-2026-69112: Improper Limitation of a Pathname to a Restricted Directory

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...