CVE-2025-29306

POC - CVE-2025-29306 FOXCMS /images/index.html Code Execution Vulnerability Overview An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Full POC Read about it — CVE-2025-29306 Disclaimer : This Proof of Concept POC ...

CVE-2025-29306_poc

Description Published: 2025-03-27 Updated: 2025-03-27 An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Usage: python testpoc.py -u http://192.168.0.1/images/index.html "id" python testpoc.py -f url.txt "id"...

CVE-2021-40444--CABless

CVE-2021-40444--CABless version Update: Modified code so that we don´t need to rely on CAB archives the file "index.html" that triggers payload execution will contain 1 line of code only, inside 'script' tag: An article in PDF format is provided. Update: link to video demo -...

CVE-2026-100636 SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences...

CVE-2026-100636 SiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write arbitrary HTML content to index.html outside the workspace directory. Attackers can supply a folder parameter with directory traversal sequences...

CVE-2026-97878

A vulnerability exists in zhistaredu StarTraining up to version 3.8.1 within the Druid Console component. Specifically, the anonymous function of the file /druid/index.html is affected. This flaw allows for missing authentication , enabling an attacker to perform the attack remotely . An exploit ...

CVE-2026-97878 zhistaredu StarTraining Druid Console index.html anonymous missing authentication

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

CVE-2026-97878 zhistaredu StarTraining Druid Console index.html anonymous missing authentication

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

EUVD-2026-87235

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

CVE-2026-27867

The Regesta Smart HD-PLC (model TLDPH16D2 ) by Teldat is vulnerable to Cross-Site Scripting (XSS) in firmware version 11.02.06.00.02 . An attacker with network access and the required registration privileges can inject a malicious payload via the cmdcookie parameter within the /upgrade/index.html...

PT-2026-98460

Name of the Vulnerable Software and Affected Versions Regesta Smart HD-PLC - TLDPH16D2 version 11.02.06.00.02 Description A network attacker with registration access can perform Cross-Site Scripting XSS by injecting a specific payload via the cmdcookie parameter within the '/upgrade/index.html'...

PT-2026-98935

Name of the Vulnerable Software and Affected Versions zhistaredu StarTraining versions prior to 3.8.2 Description A remote issue exists in the Druid Console component within the /druid/index.html file. The anonymous function is susceptible to manipulation, which allows an attacker to bypass...

CVE-2026-94493

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-94493

A missing authentication vulnerability in the WebSocket Service component of Gigatech PDV5701 version 1.0.31_240305_112640 affects the file /index.html. The flaw allows a remote attacker with no privileges to exploit the service, rated CVSS 4.0: 10.0 (Critical) with high impact across confidentia...

EUVD-2026-84259

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

PT-2026-96329

Name of the Vulnerable Software and Affected Versions Gigatech PDV5701 version 1.0.31 240305 112640 Description An issue exists in the WebSocket Service component where improper processing of the /index.html endpoint allows remote attackers to bypass authentication. Recommendations At the moment,...

CVE-2026-94493: Missing Authentication for Critical Function

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

PYSEC-2026-1840 Pyramid static view path traversal up one directory

Impact This impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...