23402 matches found
CVE-2013-1081
Este script aprovecha una inclusión de archivos locales LFI que existe en Novell Zenworks Mobile Device Management. Módulos de Metasploit - msf use auxiliary/scanner/http/novellmdmcreds msf auxiliarynovellmdmcreds show options Module options auxiliary/scanner/http/novellmdmcreds: Name Current...
CVE-2025-2294
🚨 Kubio AI Page Builder = 2.5.1 - Inclusión de archivos locales no autenticada 📝 Descripción El complemento Kubio AI Page Builder para WordPress es vulnerable a la inclusión de archivos locales en todas las versiones hasta la 2.5.1 incluida, a través de la función kubiohybridthemeloadtemplate. Es...
CVE-2024-23897-Arbitrary-file-read
🤵🏻 CVE-2024-23897 Arbitrary-file-read 🤵🏻 Versiones afectadas: Jenkins 2.441 y anteriores. Jenkins LTS 2.426.2 y anteriores. Un script realizado en python para atumatizar la vulnerabilidad CVE-2024-23897 🤖 🛠️ Este código Python presenta un escáner para una vulnerabilidad específica CVE-2024-23897 en...
CVE-2026-12227
CVE-2026-12227 — LFI no autenticado en Visual Composer Website Builder PoC en Python 3 para CVE-2026-12227 Wordfence: Inclusión Local de Archivos a través del parámetro de consulta vcv-template en Visual Composer Website Builder visualcomposer en wordpress.org. | ---|--- Plataforma| Plugin de...
CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC
Apache CXF XOP Include LFI CVE-2022-46364 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2022-46364 , una vulnerabilidad de Inclusión de Archivos Locales LFI en Apache CXF. La vulnerabilidad surge debido al manejo inadecuado de los elementos XOP XML-binary Optimiz...
CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability
CVE-2025-68645 — Zimbra Classic UI LFI Defender Pack Este repositorio es un paquete de referencia centrado en la defensa para CVE-2025-68645 , un problema de inclusión de archivos locales LFI en Zimbra Collaboration ZCS 10.0.x y 10.1.x Classic Webmail UI causado por el manejo inadecuado de...
CVE-2026-71426: Improper Limitation of a Pathname to a Restricted Directory
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...
CVE-2021-27905.POC
CVE-2021-27905.POC POC para LFI relacionado con CVE-2021-27905 POC para apache-solr-file-read plantilla de nuclei Uso traverse.sh path Por ejemplo, usando /root como ruta, mostrará el contenido de todos los archivos recursivamente ./traverse.sh /root También es posible recorrer y obtener el...
CVE-2026-87902
CVE-2026-87902 — WordPress Core Path Traversal / LFI / RCE Inclusión Local de Archivos no autenticada mediante path traversal con doble codificación en el resolvedor de plantillas de página del núcleo de WordPress, con cadena de RCE basada en PEAR. Detalles de la Vulnerabilidad Campo| Valor ---|-...
CrushFTP-SSTI-LFI-Proof-of-Concept
CVE-2024-4040 — CrushFTP SSTI / LFI 概念验证 仅供教育和授权实验室环境使用。 CS443 软件与系统安全 — 受控本地 Docker 环境。 漏洞摘要 字段| 详情 ---|--- CVE| CVE-2024-4040 受影响软件| CrushFTP …），服务器评估并返回这些载荷，从而实现跨主机任意文件读取。 实验室环境 组件| 值 ---|--- 目标| http://localhost:8080 基础 PoC CrushFTP 版本| 10.3.0（故意存在漏洞） 缓解方案 3 测试环境| 运行 CrushFTP 11.x（已修补分支）的独立容器...
CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
WordPress Simply Schedule Appointments plugin <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion vulnerability
Authenticated Subscriber+ Local File Inclusion vulnerability discovered by crow in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.27...
CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.12.27 . The root cause is the 'ssa_locale' parameter, which processes raw GET values without nonce or capability checks during the plugins_loaded action. While...
EUVD-2026-89654
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
ElasticSearch <1.6.1 - Local File Inclusion
ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...
Metabase - Local File Inclusion
Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not...
SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...
