31 matches found
CVE-2018-19422-SubrionCMS-RCE
CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 认证远程代码执行 Subrion CMS 4.2.1 中的 /panel/uploads 允许远程攻击者通过 .pht 或 .phar 文件执行任意 PHP 代码，因为 .htaccess 文件未包含这些扩展名。 漏洞利用方法 命令： Windows/Linux: $ sudo python3 subrionRCE.py -u http://IP/panel/ -l -p 参考链接： https://www.exploit-db.com/exploits/49876...
CVE-2023-49103
CVE-2023-49103 CVE-2023-49103 的 PoC 概述 该 Python 脚本旨在高效处理大量 URL，以检查是否存在 phpinfo 输出。它使用多线程并发处理大量 URL，显著加速流程。脚本还具有实时进度条，可直观跟踪进度。 要触发漏洞，仅访问 phpinfo URL 是不够的：还需要绕过 .htaccess（感谢 rapid7 的洞察）。在本例中，可通过在 URL 后添加 /.css 来实现。 要求 Python 3.x requests urllib3 colorama alive-progress concurrent.futures（Python 3...
svn-extractor
Svn-Extractor 很多时候，Web 应用渗透测试人员会遇到 .svn 文件夹。对于那些不了解的人来说，.svn 文件夹是 SVN 版本控制系统用于执行其操作的。对于黑盒渗透测试，该文件夹包含大量信息。其中一些关键的帮助领域包括： 1. 发现隐藏的文件和文件夹名称 2. 访问文件的源代码。 3. 即使 htaccess 中设置了限制，也能下载文件。 如何实现这一点。 1. 发现隐藏的文件和文件夹名称 根据所使用的 SVN 版本，有两种方法可以实现这一点。 对于 1.6 版本，我们有 .svn/wc.db，其中包含类似的数据，但采用 sqlite3 格式。 这些文件可以通过 URL...
EUVD-2026-62543
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...
CVE-2026-62673 Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...
PT-2026-78514
Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description Security rules in .htaccess and webserver-configs/htaccess.txt omit the Apache NC No Case flag, causing sensitive directory and file-extension patterns to be compared case-sensitively. On case-insensiti...
CVE-2026-5524
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the doimageupload function where user-supplied input from the acceptFileTypes POST...
CVE-2026-5524
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the doimageupload function where user-supplied input from the acceptFileTypes POST...
kleeja-auth-bypass-rce-cve
GitHub Security Advisory: Kleeja File Sharing — Critical Auth...
CLSA-2026-1778152899 httpd: Fix of 2 CVEs
CVE-2017-15710: modauthnzldap out-of-bounds write when accept-language header value is shorter than two characters - CVE-2017-15715: regex anchor in / can match before an embedded newline, allowing .htaccess bypass of trailing-extension filters...
CVE-2026-34381
Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on admmyfiles/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache configuration, which causes Apache to silently igno...
CVE-2026-34381
Admidio versions 5.0.0–5.0.7 rely on adm_my_files/.htaccess to deny direct access, but the Docker image uses AllowOverride None, so Apache ignores .htaccess. This allows unauthenticated HTTP access to uploaded documents if the path is known; the path is disclosed in the upload response JSON. The ...
CVE-2026-30875
Chamilo LMS (prior to v1.11.36) exposes an authenticated RCE via H5P Import. An attacker with Teacher role can upload a crafted H5P package that bypasses validation (H5P package validation only checks for h5p.json and does not block .htaccess or PHP files with alternate extensions), enabling exec...
CVE-2026-30875 Chamilo LMS: Authenticated RCE via H5P Import
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution RCE. The H5P package validation only checks if h5p.json exists but doesn't block...
CVE-2026-30875 Chamilo LMS: Authenticated RCE via H5P Import
Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution RCE. The H5P package validation only checks if h5p.json exists but doesn't block...
AZL-71590 CVE-2025-66200 affecting package httpd for versions less than 2.4.66-1
moduserdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are...
AZL-71528 CVE-2025-66200 affecting package httpd for versions less than 2.4.66-1
moduserdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are...
CVE-2025-12894 Import WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.14.17 via the import/export functionality and a lack of .htaccess protection. This makes it possible for unauthenticated...