MobSF - Path Traversal

MobSF is vulnerable to an issue with apktool CVE-2024-21633 that allows for RCE or arbitrary file writing. It does this through a path traversal vulnerability. This template tests for it by writing to a local file and reading that file. RCE can be achieved by overwriting jadx, as shown in the two...

CVE-2022-22954

CVE-2022-22954 CVE-2022-22954 VMware Workspace ONE Access freemarker SSTI Multiple vulnerability trigger point detection, multi-threaded batch detection, command execution, file writing // Single target vulnerability detection python CVE-2022-22954.py -u https://x.x.x.x // Command execution pytho...

CVE-2022-22954

Multi-vulnerability trigger point detection, multi-threaded batch detection, command execution, file writing // Single target vulnerability detection python CVE-2022-22954.py -u https://x.x.x.x // Command execution python CVE-2022-22954.py -u https://x.x.x.x -c "id" // Write file python...

MemFiles

MemFiles DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Technical Details, Design Considerations, and Commentary" section!...

CVE-2021-3129

CVE-2021-3129 — Laravel Ignition Remote Code Execution CVSS 9.8 Critical | Unsafe File Operations → Log Poisoning → Phar Deserialization → RCE Overview Laravel Ignition -c "whoami" References NVD — CVE-2021-3129 Ignition Patch 2.5.2...

storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token

A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network LAN. An attacker on the local network can capture this token and abuse file-writing functionali...

storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token

A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network LAN. An attacker on the local network can capture this token and abuse file-writing functionali...

storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token

A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network LAN. An attacker on the local network can capture this token and abuse file-writing functionali...

CVE-2026-114126

A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network LAN. An attacker on the local network can capture this token and abuse file-writing functionali...

CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

CVE-2026-114126

The Storybook development server is vulnerable to a security flaw where it exposes its WebSocket authentication token to clients on the local network. Affected versions include 8.0.0 to 8.6.18 , 9.1.21 , 10.6.2 , and 11.0.0-alpha.6 . A LAN attacker can obtain this token to access WebSocket-backed...

CVE-2026-77371

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371

The Redash data visualization package versions 26.0.0 through 26.9.0 are vulnerable due to a misconfiguration in the DuckDB query runner located at redash/query_runner/duckdb.py. The _connect() path fails to disable enable_external_access , leaving it at its default value of true. A user with que...

Exploit for Path Traversal in Vmware Vcenter_Server

CVE-2026-59310 – VMware vCenter Syslog Directory Traversal Lea...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958

vm2 (a Node.js sandboxing library) versions through 3.11.6 contain a builtin-module denylist bypass in NodeVM . When embedders use the wildcard with negative entries (e.g., -fs), matching is done by exact module name in lib/builtin.js, so fs/promises is not blocked. Sandboxed code can therefore c...

CVE-2026-71268

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...

PT-2026-68291

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authenticated attacker can perform a Path Traversal attack via the Knowledge Bases API endpoint POST /api/v1/knowledge bases. This issue arises because the system uses user-supplied...

CVE-2026-15307

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...