svg-cheatsheet

SVG SSRF Cheatsheet Hosts that process SVG can potentially be vulnerable to SSRF, LFI, XSS, RCE because of the rich feature set of SVG. All of these methods specify a URI, which can be absolute or relative. File and HTTP protocol are important to test, but it could also support other protocols...

CVE-2026-22804

Termix Stored XSS PoC GHSA-m3cv-5hgp-hv35 This repository contains a Proof of Concept PoC exploit for the Stored Cross-Site Scripting XSS vulnerability in Termix, which can lead to Local File Inclusion LFI in the Electron environment and Session Hijacking. Vulnerability Details Advisory :...

CVE-2026-22692

CVE-2026-22692: Critical Twig Sandbox Bypass via collect-mapInto allowing RCE/LFI/XXE October CMS Overview Field| Details ---|--- CVE ID| CVE-2026-22692 Severity| Moderate CVSS:3.1 4.9 Advisory| GHSA-m5qg-jc75-4jp6 Affected Product| October CMS RCE, LFI, XXE Discovered by| Lukasz Rybak CWE...

CVE-2024-58388

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...

CVE-2024-3673

CVE-2024-3673 CVE-2024-3673 Exploit: Local File Inclusion in Web Directory Free WordPress Plugin before 1.7.3 Overview CVE-2024-3673 describes a critical vulnerability in the Web Directory Free WordPress plugin versions prior to 1.7.3. The plugin fails to validate a parameter before using it in a...

jsPDF-Bulk-Detector-CVE-2025-68428-

🚨 jsPDF Bulk Detector – CVE-2025-68428 🚨 Asset-wide detection tool for identifying jsPDF usage related to CVE-2025-68428. Detection only — no exploitation. 🚨 Background A critical vulnerability was disclosed in the popular JavaScript PDF generation library jsPDF, tracked as CVE-2025-68428...

CVE-2025-55853

CVE-2025-55853 - Local File Inclusion via Server Side Request Forgery SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery SSRF. About This PoC for CVE-2025-55853 demonstrates Server Side Request Forgery in the webPDF tool webPDF. used to convert files to PDF. The PDF...

CVE-2023-39141-LFI-enumerator

Enumerate remote server files by exploiting CVE-2023-39141 See POC: https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e...

CVE-2024-58388

Sharp and Toshiba Tec rebranded multifunction printers are vulnerable to an unauthenticated local file inclusion (LFI) vulnerability. The root cause is the lack of input validation on the path parameter within the installed_emanual_down.html endpoint. Remote attackers can leverage directory trave...

CVE-2024-58388 Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...

CVE-2025-26240

CVE-2025-26240 This is proof of concept code for exploitation of the pdfkit fromstring method. It contains simple payload demonstrating both LFI and SSRF...

CVE-2024-6460

CVE--2024-6460 Grow by Tradedoubler 2.0.22 - Unauthenticated LFI Usage ausage: CVE-2024-6460.py -h -u URL -U USERNAME -P PASSWORD -c COMPONENT Grow by Tradedoubler 2.0.22 - Unauthenticated LFI options: -h, --help show this help message and exit -u URL, --url URL Target WordPress site URL e.g.,...

CVE-2024-53677-POC

CVE-2024-53677 A kind old vulnerability that effect Apache Struts leading to LFI, and remote exection. more info about the vulnerability you can refer to this great blog. Apache Struts path traversal → RCE CVE-2024-53677 POC usage I have send much time make this as custamizable as possiable becau...

CVE-2025-4123-Exploit-Tool-Grafana-

CVE-2025-4123 - Grafana Path Traversal Exploit Developed by mitsec This is a proof-of-concept PoC exploit tool for CVE-2025-4123 , a critical path traversal vulnerability in Grafana's /public endpoint. The exploit allows for: ✅ Server-Side Request Forgery SSRF ✅ Local File Inclusion LFI ✅ Open...

SSH-key-and-RCE-PoC-for-CVE-2021-41773

SSH Key and RCE PoC for CVE-2021-41773 This repository contains a Proof-of-Concept PoC for CVE-2021-41773. This CVE exposes a Local File Inclusion LFI and Remote Code Execution RCE vulnerability. Installation Ensure you have Go version 1.23.0 installed. Build the exploit binary with the following...

CVE-2021-41277

CVE-2021-41277 PoC Metabase is an open source data analytics platform. Local File Inclusion issue has been discovered in some versions of metabase. Here is the PoC code in order to determine the target has this vulnerability or not. An adversary could read arbitrary files in metabase server. Buil...

CVE-2025-66955

CVE-2025-66955 Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "path" parameter in the downloadAttachment and downloadAttachmentFromPath API calls. CVSS Vectors CVSS 3.1: 7.7,...

CVE-2023-40028

CVE-2023-40028: Ghost CMS Symlink Exploitation PoC Overview This repository contains a Proof-of-Concept PoC script designed to demonstrate the exploitation of CVE-2023-40028 , a Local File Inclusion LFI vulnerability affecting Ghost CMS versions prior to 5.59.1. The vulnerability allows...

Grafana-LFI-exploit

Grafana LFI exploit Updated exploit script for the CVE-2021-43798 from the following: https://www.exploit-db.com/exploits/50581 https://vulncheck.com/blog/grafana-cve-2021-43798 Usage 1. Update on line 5 ip and line 6 port to fit the target. 2. Run the script python3 grafana-exploit.py...

cve-2023-30212

cve-2023-30212 PoC for CVE-2023-30212 using Docker CVE-2023-30212 Environment Setup and PoC Report 📌 Overview This report details the direct construction of a Docker-based vulnerable web environment for CVE-2023-30212, a vulnerability not present in Vulhub, and demonstrates the vulnerability...