CVE-2025-8110

Gogs Arbitrary File Write to RCE CVE-2025-8110 - Educational Use Exploit This repository contains a Proof of Concept PoC script in Python to demonstrate and analyze the vulnerability registered as CVE-2025-8110 in the self-hosted Git service Gogs versions 0.13.3 and earlier. ⚠️ Disclaimer !WARNING...

CVE-2022-22828

CVE-2022-22828 Synametrics - SynaMan version 4.9 Summary Viden Labs has found an Insecure Direct Object Reference IDOR vulnerability in Synametric's SynaMan. This vulnerability is present in versions 4.9 and earlier. This vulnerability has since been patched in version 5.0. “Insecure direct objec...

CVE-2021-41773-PoC

CVE-2021-41773-PoC PoC for CVE-2021-41773 with docker to demonstrate Run Just run ./poc.sh. Make sure you have working docker and docker-compose $ ./poc.sh Creating network "cve-2021-41773-pocdefault" with the default driver Creating cve-2021-41773-pocweb1 ... done root:x:0:0:root:/root:/bin/bash...

CVE-2024-49668

🚨 CVE-2024-49668: WordPress Verbalize WP Plugin Arbitrary File Upload Vulnerability 📋 Overview CVE-2024-49668 is a critical vulnerability in the WordPress Verbalize WP plugin versions 1.0 and below. This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shell...

EUVD-2026-103207

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

CVE-2026-111854

A path traversal vulnerability exists in the SCPI FILESystem command interface of Tektronix 3 Series MDO devices running firmware versions before 1.21.1 . The root cause is the insufficient validation of file paths supplied to filesystem access commands, which allows remote attackers to read or m...

CVE-2022-40363

CVE-2022-40363 A buffer overflow in the component nfcdeviceloadmifareuldata of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service DoS via a crafted NFC file. authentication| complexity| vector ---|---|--- not available| not available| not available...

CVE-2017-8759

Introduction and exploitation of vulnerability CVE-2017-8759 By generating a file...

OS4Ed OpenSIS Community 8.0 - Local File Inclusion

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php modname parameter, which can disclose arbitrary file from the server's filesystem as long as the application has access to the file. id: CVE-2021-40651 info: name: OS4Ed OpenSIS Community 8.0 - Local...

Netmask NPM Package - Server-Side Request Forgery

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the...

Telesquare TLR-2855KS6 - Arbitrary File Creation

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts. id: CVE-2021-46418 info: name: Telesquare TLR-2855KS6 - Arbitrary File Creation author: DhiyaneshDK severity: high description: | An unauthorized file creation vulnerability in...

Hongdian H8922 3.0.5 Devices - Local File Inclusion

Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /logdownload.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ e.g., ../../etc/passwd This can be carried out wi...

D-Link DAP-1620 - Local File Inclusion

D-Link DAP-1620 is susceptible to local file Inclusion due to path traversal that can lead to unauthorized internal files reading /etc/passwd and /etc/shadow. id: CVE-2021-46381 info: name: D-Link DAP-1620 - Local File Inclusion author: 0xAkoko severity: high description: D-Link DAP-1620 is...

Home Assistant HACS - Local File Inclusion

Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration. id: CVE-2021-3152 info: name: Home Assistant HACS - Local File Inclusion...

AlquistManager Local File Inclusion

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access. id...

Express-handlebars - Local File Inclusion

Express-handlebars is susceptible to local file inclusion because it mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by...

Images to WebP < 1.9 - Authenticated Local File Inclusion

The Images to WebP WordPress plugin before version 1.9 did not validate or sanitize the tab parameter before using it in the include function. id: CVE-2021-24644 info: name: Images to WebP 1.9 - Authenticated Local File Inclusion author: Sourabh-Sahu severity: high description: | The Images to We...

Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions...

WordPress Imagements <=1.2.5 - Arbitrary File Upload

WordPress Imagements plugin through 1.2.5 is susceptible to arbitrary file upload which can lead to remote code execution. The plugin allows images to be uploaded in comments but only checks for the Content-Type in the request to forbid dangerous files. An attacker can upload arbitrary files by...