CVE-2020-1938

CVE-2020-1938 The tool is only for security research and internal self-inspection. It is prohibited to use the tool to launch illegal attacks. The user is responsible for any consequences. apache-tomcat-8.5.32.zip test tomcat Arbitrary file read java -jar 1.jar...

CVE-2024-23334

CVE-2024-23334 PoC Description This repository contains a Proof of Concept PoC for CVE-2024-23334, demonstrating how malicious actors can exploit vulnerabilities in aiohttp using LFI . !CAUTION Disclaimer: IMPORTANT: This PoC is for educational purposes only. Unauthorized access to computer syste...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

CVE-2021-41277

CVE-2021-41277 Metabase GeoJSON map local file inclusion Version: x.40.0-x.40.4 Usage : chmod -x CVE-2021-41277.sh ./CVE-2021-41277.sh http://ip:port/ /etc/passwd References https://vulners.com/cve/CVE-2021-41277...

CVE-2024-46987

CVE-2024-46987 - Camaleon CMS Local File Inclusion Authenticated Local File Inclusion LFI exploit for Camaleon CMS. Vulnerability Camaleon CMS is vulnerable to an authenticated LFI attack through the /admin/media/downloadprivatefile endpoint. The file parameter is not properly sanitized, allowing...

CVE-2025-1661

CVE-2025-1661 - Unauthenticated Local File Inclusion LFI in HUSKY – Products Filter Professional for WooCommerce Description The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion LFI in all versions up to and including 1.3.6.5 via the...

CVE-2020-5902-Scanner

CVE-2020-5902-Scanner Automated F5 Big IP Remote Code Execution CVE-2020-5902 Scanner Written In Python 3 Vulnerability Description F5 released a Critical Remote Code Execution vulnerability CVE-2020-5902 on 30th June 2020 that affects several versions of Big IP. Attacker can easily exploit RCE &...

Vulnerable-Web-Application

Vulnerable Web Application What is Vulnerable-Web-Application Vulnerable-Web-Application is a website that is prepared for people who are interested in web penetration and who want to have information about this subject or to be working. In fact, the website is quite simple to install and use...

CVE-2022-45771-Pwndoc-LFI-to-RCE

Pwndoc local file inclusion to remote code execution of Node.js code on the server, discovered by @yuriisanin Features Custom Node.js code to execute server-side using --payload-file Cleanup after exploit Requirements An admin account on the PwnDoc instance Usage $...

CVE-2019-9978

CVE-2019-9978 CVE-2019-9978 - PoC RCE in Social WarFare Plugin system'cat /etc/passwd' Save it with filename: payload.txt and upload it on a server. The URI should look like: https://yoursite.com/payload.txt. Finally, supply your --target and --payload-uri options: $ python cve-2019-9978.py...

CVE-2025-2294

CVE-2025-2294 - WordPress Kubio AI Page Builder = 2.5.1 - Local File Inclusion LFI Exploit Overview CVE-2025-2294 affects the Kubio AI Page Builder plugin for WordPress versions up to and including 2.5.1. It suffers from an unauthenticated Local File Inclusion LFI vulnerability via the...

CVE-2020-1938-Tomact-file_include-file_read

CVE-2020-1938Tomcat-fileinclude and filered Tomcat file inclusion and file read vulnerability exploitation POC File Read Usage :python2 "Tomcat-ROOT路径下文件读取CVE-2020-1938.py" -p 8009 -f /test.txt 127.0.0.1 File Inclusion Usage :python2 "Tomcat-ROOT路径下文件包含CVE-2020-1938.py" -p 8009 -f /test.txt...

Lfi-Space

🪐 LFI-SPACE TOOL 🪐 Written by TMRSWRR Version 1.0.0 All in one tools for LFI VULN FINDER -LFI DORK FINDER Instagram: TMRSWRR 📷 Screenshots 📷 👇 💫 How to use 💫 👇 📒 Read Me 📒 LFI Space is a robust and efficient tool designed to detect Local File Inclusion LFI vulnerabilities in web applications. Thi...

CVE-2025-2294

CVE-2025-2294 🚨 CVE-2025-2294 - Local File Inclusion LFI Vulnerability in Kubio AI Page Builder for WordPress 🧱 🔍 Overview CVE-2025-2294 is a critical 🔥 Local File Inclusion LFI vulnerability affecting the Kubio AI Page Builder plugin for WordPress versions up to and including 2.5.1. This flaw...

CVE-2025-4380

CVE-2025-4380 - Ads Pro Plugin = 4.89 - Local File Inclusion LFI Exploit Description This Python exploit targets Ads Pro Plugin ≤ 4.89 for WordPress, vulnerable to Local File Inclusion LFI via the bsapreviewcallback AJAX action. An unauthenticated attacker can exploit this to read arbitrary files...

AutoPwn-Titanic.htb

Titanic AutoPWN - HTB Machine This is an automated exploitation script for the Hack The Box machine Titanic. A full exploitation automation script for the Titanic HTB Linux machine on Hack The Box. Full write Up - WriteUp.md 📋 Description It performs the following actions: Phase 1: Retrieve and...

CVE-2018-7422

CVE-2018-12613 Local file inclusion bug due to no sanitization of user input. Software Affected 1. Wordpress Plugin: Site-Editor v.1.1.1; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1. Wordpress URL endpoint 2. A full path file to be retrieved in remote...

CVE-2023-31059-Repetier-Server-1.4.10-Unauthenticated-Path-Traversal

Repetier-Server |HTTP request with ..%5c traversal| BRepetier Server B -- Cbase/connectionLost.php C --|Unsanitized file parameter| DWindows Filesystem D -- ESensitive File E -- B B --|File contents in HTTP response| A Exploitation Example GET...

Exploit-CVE-2025-24801

CVE-2025-24801 This exploit uses CVE-2025-24801 to get Remote Code Execution RCE via Local File Inclusion LFI at GLPI 10.0.17. Proof of Concept PoC of this CVE with explaination to this vulnerability in GLPI. Observation Some applications expose the /glpi/ endpoint e.g.,...

CVE-2024-23334-PoC

CVE-2024-23334-PoC This repository is a proof of concept POC for CVE-2024-23334, demonstrating an attempt to replicate the bug in aiohttp that leads to Local File Inclusion LFI. !CAUTION Disclaimer: This POC is for educational purposes only. DO NOT use it in real-world scenarios. Install 1. Clone...