CVE-2020-1938

CVE-2020-1938 CVE-2020-1938 fixes errors in the PoC from https://github.com/Hancheng-Lei/Hacking-Vulnerability-CVE-2020-1938-Ghostcat.git and has been verified to work on Apache Tomcat/8.0.43. Practice Steps 1. Create docker-compose.yml 2. docker compose up -d 3. python3 CVE-2020-1938.py -p 8009 ...

CVE-2021-40905

CVE-2021-40905 - RCE via a crafted .mkp file Application: CheckMK Management Web Console Software Revision: Less than or equal to 2.0.0p17 Attack type: RCE Solution: TBD or the MKPs shared on https://exchange.checkmk.com/ are manually reviewed by CheckMk and they look for malicious code or...

PT-2026-122934

A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load file from uri of the file private gpt/server/ingest/uri loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request...

BeyondTrust Remote Support 26.2.3 Vulnerability Check

BeyondTrust Remote Support versions 26.2.3 and prior contain an improper-origin-validation flaw in an internal messaging component that may permit unauthorized file operations. This offline checker assesses operator-supplied version, deployment, and BT26-05-RS patch evidence without contacting...

Fortinet FortiMail 8.0.1 Path Traversal Arbitrary File Write Check

Fortinet FortiMail versions 8.0.0 through 8.0.1, 7.6.0 through 7.6.6, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.9 contain a path traversal and NULL-byte arbitrary file write vulnerability. This offline tool assesses operator-supplied version data for potential exposure...

PT-2026-122952

A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the...

PT-2026-122941

The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP...

PT-2026-122977

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing...

PT-2026-123120

Name of the Vulnerable Software and Affected Versions EyouCMS versions prior to 1.8.4 Description A flaw exists in the remote file to local function within the application/function.php file. This issue allows a remote attacker to perform server-side request forgery SSRF, a technique where the...

Amazon Linux 2023 : mariadb118, mariadb118-backup, mariadb118-client-utils (ALAS2023-2026-3287)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3287 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Amazon Linux 2023 : mariadb114, mariadb114-backup, mariadb114-client-utils (ALAS2023-2026-3288)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3288 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Amazon Linux 2023 : mariadb1011, mariadb1011-backup, mariadb1011-client-utils (ALAS2023-2026-3289)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3289 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Amazon Linux 2023 : mariadb123, mariadb123-backup, mariadb123-client-utils (ALAS2023-2026-3286)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3286 advisory. MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account...

Red Hat: CVE-2026-116137: adm-zip: adm-zip: File integrity check bypass via duplicate archive entries

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

Amazon Linux 2023 : cifs-utils, cifs-utils-devel, cifs-utils-info (ALAS2023-2026-3291)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3291 advisory. A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-...

SUSE SLES12 Security Update : cifs-utils (SUSE-SU-2026:4897-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4897-1 advisory. This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc128493...

Amazon Linux 2023 : docker (ALAS2023-2026-3266)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3266 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A...

VulnCheck KEV: CVE-2025-57231

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

Joomla Novarain Framework 6.0.37 Arbitrary File Upload

Joomla Tassos/Novarain Framework versions 4.10.14 through 6.0.37 contain an improper access control issue in the comajax endpoint. The proof of concept uses the nrinlinefileupload gadget to upload files. https://packetstorm.news/download/237459...

Amazon Linux 2 : docker (ALASECS-2026-148)

The version of docker installed on the remote host is prior to 25.0.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-148 advisory. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers...