rConfig <= 3.9.4 - Authenticated OS Command Injection

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.9.4 does not properly sanitize the fileName POST parameter before using it in a shell command, allowing an authenticated attacker to inject arbitrary OS commands. This template uses default admin credentials to log in before triggering the...

Movies <= 0.6 - Cross-Site Scripting

A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4539 info: name: Movies = 0.6 - Cross-Site Scripting author: daffainfo...

CVE-2024-34471

CVE-2024-34471 विवरण: एक प्रमाणित उपयोगकर्ता mliRealtimeEmails.php फ़ाइल में पाथ ट्रैवर्सल भेद्यता यदि लेखन अनुमतियाँ हों तो फ़ाइल विलोपन के परिणामस्वरूप का दुरुपयोग कर सकता है। export HTML कार्यक्षमता में फ़ाइलनाम पैरामीटर फ़ाइल स्थान को उचित रूप से सत्यापित नहीं करता है, जिससे हमलावर सर्वर पर...

CVE-2024-12209

CVE-2024-12209 WP Umbrella: Update Backup Restore & Monitoring = 2.17.0 - Unauthenticated Local File Inclusion Description The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename'...

CVE-2022-29597

CVE-2022-29597: Local File Inclusion in RSS v500 The RRS v500 application by Solutions Atlantic is vulnerable to a Local File Inclusion LFI vulnerability. Any authenticated user has the ability to reference internal system files within requests made to the...

CVE-2022-29598

CVE-2022-29598 : Reflected Cross-Site Scripting XSS in RSS v500 Mitre URL: https://vulners.com/cve/CVE-2022-29598 NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-29598 The RRS v500 application by Solutions Atlantic is vulnerable to a reflected Cross-Site Scripting XSS vulnerability...

CVE-2023-26255-6

Jira plugin STAGIL Navigation के FileName पैरामीटर में मनमानी फ़ाइल पढ़ने की भेद्यता हेतु POC स्क्रिप्ट उपयोग विधि निम्नानुसार है: एकल URL जाँच 1、कमांड लाइन इंटरफ़ेस के माध्यम से एकल URL पते की जाँच करें, -U पैरामीटर का उपयोग करके URL पैरामीटर पास करें 2、लौटाए गए परिणामों का निरीक्षण करें, यदि is...

CVE-2023-49031

LFI Tikit eMarketing CVE-2023-49031 Discovery On November 2023, a novel local file inclusion vulnerability was identified in the “eMarketing” platform developed by Tikit now Advanced during a client engagement. This issue was resolved with Advanced on February 2024 Affected Versions This...

gin-vulnerable

gin-vulnerable डेमो उपभोक्ता github.com/gin-gonic/gin v1.7.0 पर पिन किया गया CVE-2023-29401 के प्रति संवेदनशील। /download/:filename हैंडलर उपयोगकर्ता इनपुट को सीधे Context.FileAttachment में पास करता है — यह exploit-condition पैटर्न है जिसे Endor शोषण योग्य exploitable के रूप में फ़्लैग करता है।...

POC_CVE-2024-10829

POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...

POC_CVE-2024-36420

POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...

CVE-2024-53677

مصدر الـ POC https://y4tacker.github.io/2024/12/16/year/2024/12/Apache-Struts2-%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E9%80%BB%E8%BE%91%E7%BB%95%E8%BF%87-CVE-2024-53677-S2-067/ شروط RCE 1. لا توجد قيود على الامتدادات ذات الأنواع الخطيرة 2. يتم الحصول على اسم الملف من معاملات التحميل عند رفع الملف...

CVE-2024-31835

CVE-2024-31835 ثغرة برمجة نصية عبر المواقع Cross Site Scripting في نظام إدارة المحتوى FlatPress CMS الإصدار v1.3 تسمح لمهاجم عن بُعد بتنفيذ تعليمات برمجية عشوائية عبر حمولة مصمّمة في معلمة اسم الملف. المكوّن المتأثر: حقل رفع الملفات في لوحة تحكم FlatPress CMS الإصدار الثابت: Flatpress v1.3 - سيتم...

CVE-2025-5880

Whistle 2.9.98 contains an unpatched path traversal vulnerability because the /cgi-bin/sessions/get-temp-file endpoint fails to adequately sanitize user input in the filename parameter. By supplying absolute paths or traversal sequences like /etc/passwd, an attacker can bypass directory...

CVE-2020-5398

CVE-2020-5398 - RFDReflected File Download Attack for Spring MVC In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...

PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

CVE-2026-75111

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...