Eaton-Intelligent-Power-Manager-Local-File-Inclusion

Eaton-Intelligent-Power-Manager-Local-File-Inclusion Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file, it can lead to sensitive information disclosure, denial of service and code execution. CVE-2018-12031 To exploit vulnerability, someone could use...

HTB-Pterodactyl-Writeup

Penetration Test Report — HackTheBox: Pterodactyl Date: April 8, 2026 Target: Pterodactyl HackTheBox Difficulty: Medium OS: Linux openSUSE Leap 15.6 Tester: V0idW1re Executive Summary The Pterodactyl machine on HackTheBox presented a realistic attack scenario involving a misconfigured web...

CVE-2018-7422

CVE-2018-12613 Local file inclusion bug due to no sanitization of user input. Software Affected 1. Wordpress Plugin: Site-Editor v.1.1.1; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1. Wordpress URL endpoint 2. A full path file to be retrieved in remote...

CVE-2024-53677-POC

CVE-2024-53677 A kind old vulnerability that effect Apache Struts leading to LFI, and remote exection. more info about the vulnerability you can refer to this great blog. Apache Struts path traversal → RCE CVE-2024-53677 POC usage I have send much time make this as custamizable as possiable becau...

CVE-2024-24919

CVE-2024-24919 This project aims to create an automation to better study CVE-2024-24919. api.py : Collects possible vulnerable IPs. CVE-2024-24919.py : Performs brute force given the IP file and the directories file. worldListLFI.txt : List of Linux directories. Usage Clone this repository on you...

CVE-2023-40028

CVE-2023-40028: Ghost CMS Symlink Exploitation PoC Overview This repository contains a Proof-of-Concept PoC script designed to demonstrate the exploitation of CVE-2023-40028 , a Local File Inclusion LFI vulnerability affecting Ghost CMS versions prior to 5.59.1. The vulnerability allows...

CVE-2022-45771-Pwndoc-LFI-to-RCE

Pwndoc local file inclusion to remote code execution of Node.js code on the server, discovered by @yuriisanin Features Custom Node.js code to execute server-side using --payload-file Cleanup after exploit Requirements An admin account on the PwnDoc instance Usage $...

Metasploit-Wordpress-Canto-Exploit-RCE

Metersploit exploit module canto RCE CVE-2024-25096 & CVE-2023-3452 This exploit is a proof-of-work exploit of the RFI vulnerabilities CVE-2024-25096 and CVE-2023-3452, which allow the attacker to establish an interactive remote shell session on the target. CVE-2024-25096 abuses the abspath...

By-Poloss..-..CVE-2026-7515-PoC

CVE-2026-7515: BetterDocs Pro views-get"layouts/encyclopedia/$docstyle", 'doc' = $doc, 'excerpt' = $excerpt, 'dictionarylearnmoretext' = $learnmoretext, 'itemheadingtag' = $itemheadingtag,...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

CVE-2025-55853

CVE-2025-55853 - Local File Inclusion via Server Side Request Forgery SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery SSRF. About This PoC for CVE-2025-55853 demonstrates Server Side Request Forgery in the webPDF tool webPDF. used to convert files to PDF. The PDF...

LFI-to-RCE-SE-Suite-2.0

Remote Code Execution in SoftExpert Excellence Suite 2.0 - CVE-2023-30330 Authenticated Local File Inclusion to Remote Code Execution on SoftExpert Excellence Suite EQM. CVE-2023-30330 SE Suite 2.x versions before 2.1.3 Tested on versions: 2.0.15.31 and 2.0.15.115 LFI PoC...

CVE-2020-13424

Exploit Title: Joomla! Plugin XCloner Backup 3.5.3 - Local File Inclusion Authenticated Date: 2020-05-10 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Exploit-Db Author ID: 8763 Reference: https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version/ Vendor...

CVE-2025-68645

ZimLFI-Hunter CVE-2025-68645 ZimLFI-Hunter is a professional Proof-of-Concept PoC scanner designed to identify the CVE-2025-68645 vulnerability in Zimbra Collaboration Suite. This tool detects Local File Inclusion LFI flaws through the /h/printcalendar endpoint. 🛡️ Vulnerability Overview The...

CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability

CVE-2025-68645 — Zimbra Classic UI LFI Defender Pack This repository is a defender-focused reference pack for CVE-2025-68645 , a Local File Inclusion LFI issue in Zimbra Collaboration ZCS 10.0.x and 10.1.x Classic Webmail UI caused by improper handling of user-controlled request parameters in the...

CVE-2020-10977.py

CVE-2020-10977.py authenticated arbitrary file read for Gitlab CVE-2020-10977 usage: CVE-2020-10977.py -h --verifySSL -f FILELIST host token Exploit for the gitlab local file inclusion arbitrary authenticated file read - CVE-2020-10977. modify the variable pullfiles to include all the files you...

Microstrategy Web 7 - Local File Inclusion

Microstrategy Web 7 is vulnerable to local file inclusion via "/WebMstr7/servlet/mstrWeb" in the parameter subpage. Remote authenticated users can bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application. NOTE: this i...

Oliver 5 Library Server <8.00.008.053 - Local File Inclusion

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function. id: CVE-2021-45027 info: name: Oliver 5 Library Server 8.00.008.053 - Local File Inclusion author: gy741 severity: high description: Oliver 5 Library Server versions prior t...

Opsview Monitor Pro - Local File Inclusion

Opsview Monitor Pro prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch is vulnerable to unauthenticated local file inclusion and can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass. id:...

Pandora Fms < 3.1.1 - Directory Traversal

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...