tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

CVE-2026-95629

A flaw was found in the camel-docling component of Apache Camel. The component fails to validate or sanitize directory paths specified in message headers before passing them to the underlying document conversion tool. An attacker able to influence message headers can exploit this path traversal...

Enlogic SCADA Virtual Controller Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

Enlogic SCADA Virtual Controller Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files...

All-in-One WP Migration and Backup < 7.106 - Arbitrary Log File Write

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path. This makes it possible for unauthenticated attackers to create or append a log file in arbitrary locations outside the intended storage...

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution

n8n versions = 0.123.0 and = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. An authenticated user can exploit the Git node to overwrite critical files and execute untrusted code on the n8n server, potentially leadin...

Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write

FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled destination field from the JSON request body against the application directory with only a leading underscore prefix and no...

Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

Flowise - Path Traversal

Flowise = 2.2.8 contains a path traversal vulnerability caused by missing validation of chatflowId and chatId parameters in file handling, letting unauthenticated attackers read and write arbitrary files, exploit requires no authentication. id: CVE-2025-71334 info: name: Flowise - Path Traversal...

Newsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, wri...

DB-GPT <= 0.8.1 - Arbitrary File Write

DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the userid HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON...

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write

W3 Total Cache WordPress plugin 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication. id: CVE-2026-18051 info:...

Camaleon CMS < 2.8.1 Arbitrary File Write to RCE

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

esm.sh <= v136 - Arbitrary File Write via Path Traversal

esm.sh = 136 contains a path traversal caused by improper canonicalization of the X-Zone-Id HTTP header, letting attackers write files outside the intended storage directory, exploit requires crafted header input. id: CVE-2025-59342 info: name: esm.sh = v136 - Arbitrary File Write via Path...

PyTorch TorchServe SSRF

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity...

dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dashuploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges. id: CVE-2026-38360 info: name:...

CVE-2026-119083

A flaw was found in GluonTS. An attacker can achieve arbitrary file write by providing a specially crafted archive containing symbolic or hard links to the archive extraction utility. When unpacked, files can be written outside the intended destination directory with the privileges of the running...