Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wpajaxnoprivelvwplogdownload AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, whi...

PT-2026-122244

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper...

CVE-2026-111925

Mopidy before 4.0.5 contains a path traversal vulnerability that allow...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC & Reproduce This repository contains Proof-of-Concept PoC exploit code and instructions to reproduce the Local File Inclusion LFI vulnerability in MLflow, identified as CVE-2023-1177. Vulnerability Information: CVE ID: CVE-2023-1177 Vulnerability Type: Local File...

Poc_CVE-2025-68645

CVE-2025-68645 - Zimbra Path Traversal Vulnerability 📋 Overview CVE-2025-68645 is a path traversal vulnerability in Zimbra Collaboration Suite that allows unauthenticated attackers to read arbitrary files from the server's filesystem. Vulnerable Endpoint...

Gitea-Forgejo-CVE-2025-68937

Arbitrary template expansion vulnerability in Gitea and Forgejo This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Summary While checking Forgejo's and Gitea's source code to better understand how templating is performed, I discovered a vulnerability...

CVE-2026-115354 Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

CVE-2026-115354 Mistune before 3.3.0 Arbitrary Local File Read via Include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read can disclose files such as /etc/passwd and inject...

CVE-2026-115354

Mistune versions before 3.3.0 are vulnerable to a path traversal vulnerability within the opt-in Include directive . An attacker who can submit Markdown to be processed via Markdown.read() can provide relative or absolute paths to read arbitrary local files, such as /etc/passwd . Additionally, th...

Ni8mare

🔒 Ni8mare Scanner Ethical Security Scanner for CVE-2026-21858 Ni8mare Vulnerability "Knowledge is power, but only if shared responsibly." Comprehensive vulnerability detection tool for n8n workflow automation instances. Detects the critical CVE-2026-21858 vulnerability CVSS 10.0 without performin...

CVE-2026-114606 draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...

CVE-2026-114606

Versions of draw.io Desktop prior to 31.4.4 are vulnerable to arbitrary local-file disclosure . The root cause is an authorization asymmetry in the Electron main process's read-side IPC handlers. While write-side handlers (such as saveFile and writeFile) are protected by assertWritablePath, the r...

CVE-2026-114606 draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...

CVE-2019-25779

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...

CVE-2026-114665 Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read...

EUVD-2026-108121

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary files. Attackers with repository write access can commit a symlink pointing outside the project directory to read...

CVE-2026-114665

Goploy versions 1.18.0 before 1.18.1 are vulnerable to a link following vulnerability within the /deploy/fileDiff and /deploy/fileCompare endpoints. This flaw allows authenticated members to perform arbitrary file reads . Specifically, an attacker with repository write access can commit a symlink...

EUVD-2019-20210

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...

CVE-2025-7766

CVE-2025-7766 PoC Exploit PoC for exploiting XML External Entity vulnerability in CVE-2025-7766. Demonstrates file read /etc/passwd and out-of-band HTTP callbacks. Author : Byte Reaper CVE : CVE-2025-7766 Vulnerability : Remote Code Execution via XML External Entity XXE PoC for exploiting XXE in...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...