CVE-2024-12849-Poc

CVE-2024-12849-Poc 📜 Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of...

EUVD-2026-105152

Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix...

CVE-2025-8081-Elementor

CVE-2025-8081 - Elementor Arbitrary File Read Vulnerability A critical arbitrary file read vulnerability in Elementor WordPress plugin that allows authenticated administrators to read any file accessible by the web server, including sensitive configuration files containing database credentials. 📋...

CVE-2026-114491

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

EUVD-2026-107419

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line Version: djust v1.1.4 latest release, published 2026-09-23. File: python/djust/mcp/server.py:354-433 MCP tool findhandlersfortemplate. Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool def...

GHSA-R57G-MC79-8HJ2 djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool

Affected version / file / line Version: djust v1.1.4 latest release, published 2026-09-23. File: python/djust/mcp/server.py:354-433 MCP tool findhandlersfortemplate. Confirmed identical on the commit used for triage, a7e4fafd1667b4db0b1465652d4a63cb17117a07. Description @mcp.tool def...

ktor-xxe-poc

CVE-2023-45612: JetBrains Ktor XXE Proof of Concept This repository contains a vulnerable Ktor server to demonstrate the XML External Entity XXE injection vulnerability identified in CVE-2023-45612. The vulnerability exists in Ktor versions before 2.3.5 when the ContentNegotiation plugin is used...

poc-yaws-dav-xxe

XXE in Yaws web server CVE-2020-24379 Proof of concept Build test image: docker build -t vulnbe/yaws-pocs:xxe-dav-mod -f Dockerfile . and/or Run container docker run --rm -d -i -p 127.0.0.1:8000:8080 vulnbe/yaws-pocs:xxe-dav-mod Then run: curl -i -s -k -X LOCK http://localhost:8000/ -H 'Timeout:...

CVE-2026-114462

The Velneo vServer HTTP Server is vulnerable to an arbitrary file read via symlink due to improper link resolution before file access (CWE-59). This vulnerability affects versions 32.3 to 36.6 and 37.1 to 37.2 . The impact allows for high confidentiality loss on the vulnerable system. No specific...

CVE-2026-114462 Arbitrary File Read via Symlink in Velneo vServer HTTP Server

Improper link resolution before file access 'link following' vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2...

MAL-010

MAL-010: Dangerous MBeans Accessible via JMX in Apache James By listing and inspecting the MBeans exposed by the JMX on localhost, port 9999, the following attack vectors have been identified: Arbitrary File Write using Log4J Arbitrary File Read using Log4J Note: Unlike the “MLet attack” presente...

CVE-2024-12849

CVE-2024-12849 Error Log Viewer By WP Guru = 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read Description The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the...

pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Apache-Solr-Arbitrary-File-Read

Apache Solr Arbitrary File Read Hit Counter Apache Solr stands for Searching On Lucene with Replication is a free, open-source search engine based on the Apache Lucene library. Written in Java. Apache Solr has RESTful XML/HTTP and JSON APIs and client libraries for many programming languages such...

Vibe-Trading File-read Tools Expose Arbitrary Server-readable Files

Summary: 2 findings — "safeuserpath" accepts any path under "Path.home" or "Path.cwd", which inside the shipped root container resolves to "/root" and "/app" so all of root's home, including "/root/.ssh/idrsa", "/root/.aws/credentials", "/root/.kube/config", and "/app/agent/.env", passes the chec...

health-check

health-check Health Check & Troubleshooting daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin ...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana Unauthorized File Read Affected versions: 8.0.0-lastest reference: - https://github.com/tangxiaofeng7/Grafana-File-Read Exploit the Grafana /public/plugins endpoint's lax URL route validation vulnerability to read arbitrary local files from the server. poc:...

CVE-2025-30208-Vite

CVE-2025-30208 | Vite Script This tool is used to detect whether the target system has the CVE-2025-30208 vulnerability. This vulnerability allows an attacker to read sensitive files such as /etc/passwd or C:\windows\win.ini from the server via a specific path. The tool supports single URL...