Avigilon VideoIQ Camera Path Traversal

Module exploits Avigilon VideoIQ Camera Path Traversal vulnerability. If target is vulnerable it is possible to read file from file system. !/usr/bin/env python3 -- coding: utf-8 -- """Avigilon VideoIQ Camera Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient...

Cisco Firepower Management 6.0 Path Traversal

Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. If the target is vulnerable, it is possible to retrieve content of the arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Firepower Management 6.0 Path Traversal""" import re from kittysploit import from...

Cisco Unified Multi Path Traversal

Module exploits path traversal vulnerability in Cisco Unified Communications Manager, Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 --...

Zyxel ZyWALL USG Extract Hashes

Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export. If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations. !/usr/bin/env python3 ...

Cisco Video Surveillance Path Traversal

Module exploits path traversal vulnerability in Cisco Video Surveillance Operations Manager 6.3.2 devices. If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Video Surveillance Path Traversal""" import re from kittysploit...

D-Link DVG-N5402SP Path Traversal

Module exploits D-Link DVG-N5402SP path traversal vulnerability, which allows reading files form the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DVG-N5402SP Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

TP-Link WDR740ND & WDR740N Path Traversal

Exploits TP-Link WDR740ND and WDR740N path traversal vulnerabilitythat allowsto read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND & WDR740N Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

XiongMai UC-HTTPd Path Traversal

Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable it is possible to list directories and read files from the file system. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai UC-HTTPd Path Traversal""" import re from kittysploit import fr...

Malicious code in deepface-weights (PyPI)

Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working directory. When found, it POSTs the session file together...

Malicious code in deepface-weight (PyPI)

Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for approximately 10 minutes and POSTs the file to a hardcoded...

PT-2026-78292

Name of the Vulnerable Software and Affected Versions JetEngine WordPress plugin versions prior to 3.8.14 Description Insufficient sanitization of uploaded SVG files allows users with file upload capabilities, such as Authors, to upload files containing malicious JavaScript. This leads to Stored...

PT-2026-78325

Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 26.8.16330.2 Description An authenticated attacker can perform HTML injection to modify the web user interface contents displayed to other users. Recommendations Update to version 26.8.16330.2...

VulnCheck KEV: CVE-2026-32475

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-76358: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file...

CVE-2026-76342: Incorrect Authorization

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

CVE-2026-76337: Improper Limitation of a Pathname to a Restricted Directory

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory...

CVE-2026-32475: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-15061: Improper Limitation of a Pathname to a Restricted Directory

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal...

CVE-2026-18372: Improper Neutralization of Input During Web Page Generation

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18202: Improper Neutralization of Input During Web Page Generation

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who...