CVE-2024-24919

CVE-2024-24919 Exploit Overview This repository contains a proof-of-concept PoC exploit for CVE-2024-24919, a critical vulnerability discovered in Check Point SVN. The vulnerability allows for reading system files. CVE ID : CVE-2024-24919 Severity : Critical Table of Contents Vulnerability-detail...

File-Injector

File Injector If you want to use a previous version 1.0.2 or lower, where you needed the original image to extract the file, you can download it here. Index 1. Description 2. Getting Started Install requirements Run the script Choose input Choose a base image/audio Choose an input file...

CVE-2026-110775

Nexent versions up to and including 2.7.0 are vulnerable to a missing authorization flaw within the check_file_access function. The root cause is the failure to perform tenant comparisons during knowledge_base/ reads, which allows authenticated users in multi-tenant environments to access data be...

CVE-2026-110774

The Blinko application (versions through 1.8.8 ) is vulnerable to a broken access control flaw in the /api/file route. This vulnerability arises from a flawed owner check , allowing authenticated users to bypass authorization and read private attachments belonging to other users. An attacker can ...

CVE-2019-1253

CVE-2019-1253 AppXSvc Arbitrary File Security Descriptor Overwrite EoP I have independently reported this vulnerability to MSRC, however, my submission turned out to be a duplicate due to the fact that the fix for CVE-2019-1253 also addressed this issue. My PoC differs from the ones created by...

CVE-2026-110767

The Gitingest tool, versions through 0.3.1 , is vulnerable to an arbitrary file read via a symlink following flaw in the ingest_query single-file blob ingestion component. An unauthenticated attacker can exploit this by submitting a blob URL pointing to a symlink committed in a public repository....

CVE-2026-110764

AstronRPA versions through 1.1.6 are vulnerable to a Cross-Tenant File Disclosure via the resource-service /file/download endpoint. The root cause is an Insecure Direct Object Reference (IDOR) in the FileMapper.getFile function, which fails to perform ownership or tenant checks. This allows authe...

Inline-Execute-PE

Inline-Execute-PE DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Design Considerations and Commentary" section! Introducti...

Vulnerability exposure in Cisco Secure Email Gateway

Cisco has identified a vulnerability in Cisco Secure Email Gateway, specifically in the Advanced Malware Protection feature. The vulnerability lies in the way the Advanced Malware Protection feature processes email attachments when the file reputation service is enabled. An unauthenticated extern...

CVE-2024-31848-PoC

Exploiting CData within Jetty servers - CVE-2024-31848/49/50/51 - File Path Traversal & File Read What it is A prototype PoC for the automation of vulnerability analysis on targets running CData applications on an embedded Jetty server. Usage Just use -u or --url to specify your target, the scrip...

COM-Hunter

COM-Hunter COM Hijacking VOODOO Description COM-Hunter is a COM Hijacking persistence tool. Available in both a .NET version and a BOF variant fully compatible with Cobalt Strike. The following list explains the available modes: Search Mode : Searches for CLSIDs based on LocalServer32,...

WinRAR-CVE-2023-38831

WinRAR-CVE-2023-38831 This Metasploit module exploits a vulnerability in WinRAR 6.22 CVE-2023-38831. When a user opens a crafted RAR file and its embedded document, the decoy document is executed, leading to code execution. It is not pretty, but works. 🤷🏻 Alexander Hagenah @xaitax References...

CVE-2026-110666

The cemtan sar2html software (version 4.0.0 ) contains a path traversal vulnerability within the File Upload component. Specifically, the updateDb function in the sar2html.py file is affected, which could allow for remote exploitation . No information regarding a specific fix or patch is currentl...

shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

CVE-2021-22204

Vulnerable Version 7.44 12.23 Reproduce $ bash craftadjvuexploit.sh 'cal' $ ./exiftool delicate.jpg Screenshot Reference NVD-CVE-2021-22204...

tinyfilemanager-wh1z-edition

Tiny File Manager WH1Z-Edition Introducing Tiny File Manager WH1Z-Edition, the compact and efficient solution for managing your files and folders with enhanced privacy and security features. Gone are the days of relying on external resources – I've stripped down the code to its core, making it...

spring-core-rce

spring-core-rce spring core rce simple exploitation A war file is available at https://github.com/fengguangbin/spring-rce-war For Docker environment, you can use https://github.com/lunasec-io/Spring4Shell-POC You can also use the online environment at http://vulfocus.io/ or the vulhub vulnerable...

CVE-2024-23897

CVE-2024-23897 This repository presents a proof-of-concept of CVE-2024-23897 Discovered by sonarsource CVE-2024-23897 | File read in jenkins Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on confluence instances they don't own. This tool has been...

diskwalker

Diskwalker a simple script to walk your disk and keep track of interesting sets of files After gaining access to a remote machine during penetration testing, you might want to find interesting configuration files or binaries to attempt a privilege escalation. The script is self contained, and wor...

Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Attackers are exploiting a critical flaw in Cisco Secure Email Gateway that lets a sender with no login write files to the appliance's operating system, Cisco said in an advisory on Wednesday. The attacker sends an email with a crafted attachment through the gateway and, if it succeeds, could the...