CVE-2015-6668

CVE-2015-6668 - Job Manager IDOR Una pequeña CLI en Rust que reproduce el patrón de divulgación de información asociado con CVE-2015-6668 Job Manager //nombrearchivo.ext. Patrón de ataque: fuerza bruta / enumeración de carpetas comunes de año/mes y variantes de nombres de archivo para localizar...

SharePointDumper

SharePointDumper SharePointDumper es una utilidad de extracción y auditoría basada en PowerShell que enumera los sitios de SharePoint a los que un usuario puede acceder a través de Microsoft Graph y descarga archivos a través de SharePoint. Está diseñado para pruebas de SOC / DLP, purple teaming ...

shortscan

🌀 Shortscan 一个IIS短文件名枚举工具。 功能 Shortscan旨在快速确定IIS Web服务器上存在哪些具有短文件名的文件。一旦识别出短文件名，该工具将尝试自动识别完整的文件名。 除了标准发现方法外，Shortscan还使用独特的校验和匹配方法来尝试查找长文件名，其中短文件名基于Windows专有的短名称冲突避免校验和算法（关于此研究的更多信息将在日后发布）。 安装 快速安装 使用最新版本的Go: go install github.com/bitquark/shortscan/cmd/shortscan@latest 手动安装 要在本地构建（并可选择安装）： go ge...

SnaffPoint

SnaffPoint What is it SnaffPoint is a tool for pointesters who are in need of some sweetness in this world. It should help you find sensitive files available on SharePoint online and on shared OneDrive files for your company or your customer. How does it work There are actually 2 tools:...

SSH-Private-Key-Looting-Wordlists

利用LFI进行横向移动？获取SSH访问权限？ ?file=../../../../../../../../home/user/.ssh/idrsa ?file=../../../../../../../../home/user/.ssh/idrsa-cert SSH私钥窃取字典清单 🔒🗝️ 本仓库包含一系列用于协助定位或暴力破解SSH私钥文件名的字典清单。这些字典对于渗透测试人员、安全研究人员以及任何有兴趣评估SSH配置安全性的人士都非常有用。 字典文件 📝 ssh-priv-key-loot-common.txt ：SSH私钥文件的默认和常见命名约定。...

CVE-2024-23897

CVE-2024-23897 Herramienta de scraping para enumerar directorios o archivos con la vulnerabilidad CVE-2024-23897 en Jenkins. Uso python3 scraping.py -u http://server:8080 -l /path/to/wordlist -o output.txt...

CVE-2023-39141-LFI-enumerator

Enumerar archivos de servidor remoto explotando CVE-2023-39141 Ver POC: https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e...

K000163497: Podman vulnerability CVE-2024-11218

Security Advisory Description A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778236507)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778236507 advisory. - A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This...

CentOS Linux 7 [TuxCare] Security Update: rsync (CENTOS7:CLSA-2026:1777544655)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777544655 advisory. - A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs...

CVE-2020-3452-Exploit

CVE-2020-3452-Exploit Solo un exploit básico que abusa de CVE-2020-3452 para enumerar los archivos estándar accesibles en el directorio web de los dispositivos CISCO ASA/FTD. Uso: Por defecto, esto utiliza una lista de archivos construida a partir de la salida de muestra de CVE-2018-0296 en...

cve-2020-3452

CVE-2020-3452-Exploit For Educational Purpose ONLY! Just basic exploit abusing CVE-2020-3452 to enumerate the standard files accessible in the Web Directory of CISCO ASA/FTD applicances. Usage: By default this uses a file list constructed from sample output from CVE-2018-0296 in the Metasploit...

CVE-2026-95693

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

EUVD-2026-84492

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

CVE-2026-95693 MISP Information Disclosure via Forged Upload Path

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmpname field by invoking fileexists, mimecontenttype, and exifimagetype on the supplied path before verifying that the value was a genuine PHP upload via isuploadedfile. An authenticated user holding the permadd...

PT-2026-96767

In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp name field by invoking file exists, mime content type, and exif imagetype on the supplied path before verifying that the value was a genuine PHP upload via is uploaded file. An authenticated user holding the perm ad...

CVE-2025-15693: Improper Limitation of a Pathname to a Restricted Directory

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...

PT-2026-86316

🚨 CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to...

CVE-2026-85671 QAnything 2.0.0 Unauthenticated Cross-User File Disclosure

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

CVE-2026-72697: Improper Limitation of a Pathname to a Restricted Directory

Grav CMS before 2.0.16 contains a path traversal vulnerability in the mediadirectory Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem...