Panoptic

Panoptic Panoptic is an open source penetration testing tool that automates the search and retrieval of common log and config files through path traversal vulnerabilities. Features Async concurrent scanning with configurable worker pool --concurrency Automatic discovery of common log and...

XXEinjector

XXEinjector XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications. Options: --host Mandatory - our IP address for reverse connections. --host=192.168.0.2 --file...

Joomla! Component Jw_allVideos - Arbitrary File Retrieval

A directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos JwallVideos plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ modified dot dot in the file parameter. id: CVE-2010-0696 info: name: Joomla! Component...

WordPress Simple Job Board <2.9.4 - Local File Inclusion

WordPress Simple Job Board prior to version 2.9.4 is vulnerable to arbitrary file retrieval vulnerabilities because it does not validate the sjbfile parameter when viewing a resume, allowing an authenticated user with the downloadresume capability such as HR users to download arbitrary files from...

Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. id: CVE-2020-29453 info: name: Jira Server Pre-Auth - Arbitrary File...

SMBCrunch

SMBCrunch One of the most time consuming tasks as a red teamer is diving into filesystems and shares, attempting to identify any potentially sensitive information. SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network, performs a recursive directory listing of the...

CVE-2024-24919

Checkpoint POC Exploit for testing purposes to retrieve sensitive files from Checkpoint based on this article: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/ I am not responsible for any abuse of this script, the intention here is for defenders to test their own devices...

CVE-2018-8097-PoC

CVE-2018-8097 POC for CVE-2018-8097 This script exploits CVE-2018-8097 and can retrieve files and contents using a time based blind RCE method. Usage python cve-2018-8097.py -h -u URL -c COMMAND -t TIME -id OBJECTID -d FILEPATH options: -h, --help show this help message and exit -u, --url URL...

CVE-2016-5639

CVE-2016-5639 Crestron AirMedia AM-100 Traversal and Hashdump Metasploit Modules Two similar modules that take advantage of CVE-2016-5639 to dump hashes and retrieve files through path traversal. I made these modules separate because I wanted experience writing something that could "dump" hashes,...

WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval

WordPress Email Subscribers & Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative...

ExploitWebmin

Script Webmin Project created by: Gabriel Jose. Python script to exploit webmin vulnerability cve-2006-3392 Example of how to use ./exploitWebmin.py -pt http -t host -p port -f file ./exploitWebmin.py -pt http -t 127.0.0.1 -p 10000 -f /etc/passwd...

CVE-2018-7422

CVE-2018-12613 Local file inclusion bug due to no sanitization of user input. Software Affected 1. Wordpress Plugin: Site-Editor v.1.1.1; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1. Wordpress URL endpoint 2. A full path file to be retrieved in remote...

ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval

ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. id: CVE-2017-11512 info...

CVE-2024-55557

CVE-2024-55557 Usage python3 exploit.py --local retrieve from local readable files python3 exploit.py default mode is remote More Read more on CVE-2024-55557 - Weasis 4.5.1 POC https://github.com/user-attachments/assets/a3f64a58-7720-4f93-8bcc-9393d8afcb68...

CVE-2026-33367

The Red Lion Controls N-Tron 700 Series is vulnerable to a missing authentication flaw where SNMP can be used to perform administrative actions. Attackers can retrieve configuration files, modify user accounts or device settings, and initiate firmware or bootloader upgrades/downgrades without any...

modsecurity-backdoor

ModSecurity Backdoor Description This is a proof-of-concept of malicious software running inside of ModSecurity WAF. Software has two main functions: Retrieving content of files. Running commands and retrieving output remote shell. Additionaly, it includes these functions: Dynamic setting of...

Myesve

myesve CVE-2024-38475 Exploitation Framework – Version 1.0 Disclaimer: This tool is intended for authorized security testing, educational research, and legitimate bug bounty programs only. Do not use it against systems you do not own or lack explicit permission to test. The authors assume no...

CVE-2025-60574

Descubridores de Vulnerabilidades y Autores de Exploits Stefano Andreatta & Jacopo Candido Augelli CVE-2025-60574 Descripción de la Vulnerabilidad Se ha identificado una vulnerabilidad de Inclusión de Archivos Locales LFI en tQuadra CMS 4.2.1117. El problema existe en la ruta "/styles/", que no...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

PT-2026-96307

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description An authorization bypass exists in the FileAnyoneController that allows authenticated users to download arbitrary attachments. By providing valid attachment identifiers to the '/anyone/file/down'...