TFTPlunder

TFTPlunder: an exploit for CVE-2023-29930 This is an exploit script for a blind file read / write vulnerability in the Genesys formerly InIn TFTP provisioning server. Vulnerability info This vulnerability is due to unrestricted configuration options for the TFTP root path and file extensions. In...

vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

CVE-2026-45504

CVE-2026-45504 Exchange File Read CVE-2026-45504 Exchange File Read Research Blog python3 CVE-2026-45504.py --attacker-ip 192.168.2.238 --attacker-port 9020 --creds [email protected] --password Hawktrace1 --target https://mail.exchange.local --target-file...

Rogue-MySql-Server

Rogue-MySql-Server Edit script and change file to read and server port if you want. Run script and connect to your server for read file from client side. Read mysql.log for readed file content...

CVE-2021-21402-Jellyfin

CVE-2021-21402-Jellyfin Arbitrary File Read This POC is for learning and communication only. I am not responsible for any consequences arising from its use. python POC.py targets.txt...

CVE-2025-25257

CVE-2025-25257 FortiWeb CVE-2025-25257 exploit https://pwner.gg/blog/2025-07-10-fortiweb-fabric-rce exp.py: working/full exploit. signed.py: just a PoC of file read/write. initial version of the exploit...

CVE-2026-22812-POC

OpenCode CVE-2026-22812 Exploiter Simple Python tols to check and exploit OpenCode vulnerability CVE-2026-22812. Install git clone https://github.com/CayberMods/CVE-2026-22812-POC.git cd CVE-2026-22812-POC pip install requests urllib3 argparse concurrent-log-handler colorama Basic Usage Check...

php_filter_chains_oracle_exploit

PHP filter chains: file read from error-based oracle A CLI to exploit parameters affected by the file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions, such as file, hashfile, filegetcontents or...

CVE-2026-115931 Arbitrary file read and backend crash through unrestricted provider method calls

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads...

CVE-2026-115931

The Postiz application contains a vulnerability where the backend fails to restrict which functions can be requested via connected channels. This allows a signed-in user to call internal helper functions, leading to arbitrary file read and backend crash . By providing a file path as a stored toke...

nginx-rift-private-lab

NGINX Rift RCE Proof of concept for CVE-2026-42945 , a critical heap buffer overflow in NGINX's ngxhttprewritemodule introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives. This fork extends the original PoC with an ASLR-bypass...

CVE-2026-39363

CVE-2026-39363 Vite Dev Server WebSocket Arbitrary File Read Vulnerability Vulnerability Overview Attribute| Information ---|--- CVE ID| CVE-2026-39363 GHSA ID| GHSA-p9ff-h696-f583 Vulnerability Type| Arbitrary File Read Affected Component| Vite Dev Server Affected Versions| Vite = 6.2.3...

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest projects entry or a Vitest test.projects entry can name a path. Fallow followed such an entry to a config file and read that file, also when the file was outside the project root. These forms reached outsid...

PoC-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Exploit A Python exploit for CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49 that allows reading arbitrary files from the server. Vulnerability Details CVE-2021-41773 is a path traversal vulnerability in Apache HTTP Serv...

CVE-2025-46822

CVE-2025-46822 Unauthenticated Arbitrary File Read via Absolute Path Description: While Path.resolve method is being used to protect against path traversal I have found that the usage of absolute path successfully read internal files , the endpoint is also not authenticated this means anyone can...

es_inject

CVE-2014-3120 Elastic Search Remote Code Execution This project demonstrates the CVE-2014-3120 vulnerability/misconfiguration. It allows you to read from and append to files on the system hosting ES, provided the user running ES has access to them. Notes This does not require a web server. Save i...

CVE_2024_42007

CVE-2024-42007 - php-spx Path Traversal Exploit This repository contains a Python 3 proof-of-concept PoC script for CVE-2024-42007. Vulnerability Summary: php-spx = 0.4.15 suffers from a path traversal vulnerability via the SPXUIURI parameter, allowing unauthenticated attackers to read arbitrary...

cve-2022-44268

Exploit tailored for HackTheBox Pilgrimage Automatic python script using cve-2022-44268 to add a profile value with a filename from a input filelist in an input file, update the image file upload using a input request.req file from Burpsuite already included of the file upload uploading each...

day03-jenkins-23897

Day 3 — Jenkins CLI arbitrary file read CVE-2024-23897 Idea: Jenkins ≤ 2.441 LTS ≤ 2.426.2 expands @/path inside CLI args. Unauthenticated users can make Jenkins read local files and reflect their first lines via the CLI help output. Fixed in 2.442 / 2.426.3. Build → Run 1 Build docker build -t...

lighttpd-win32-dotdot-space

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lighttpd-win32-dotdot-space lighttpd-win32-dotdot-space Class: File read Reach: Remote lighttpd 1.4.85 4852959 - lighttpd Native WIN32 staticfile joins document-root to relpath after bufferpathsimplify. Simplify only...