23402 matches found
cve-2023-30212
cve-2023-30212 PoC para CVE-2023-30212 usando Docker Configuración del entorno CVE-2023-30212 e informe PoC 📌 Resumen Este informe contiene la configuración directa de un entorno web vulnerable basado en Docker para la vulnerabilidad CVE-2023-30212 no disponible en Vulhub, y la demostración de...
CVE-2013-1081
此脚本利用了Novell Zenworks移动设备管理中存在的一个本地文件包含（LFI）漏洞。 Metasploit模块 - msf use auxiliary/scanner/http/novellmdmcreds msf auxiliarynovellmdmcreds show options 模块选项 auxiliary/scanner/http/novellmdmcreds: Name Current Setting Required Description Proxies no 使用代理链 RHOSTS yes 目标地址范围或CIDR标识 RPORT 80 yes 默认远程端口...
CVE-2025-2294
🚨 Kubio AI Page Builder = 2.5.1 - 未认证本地文件包含 📝 描述 Kubio AI Page Builder WordPress 插件在 2.5.1 及之前的所有版本中，通过 kubiohybridthemeloadtemplate 函数存在本地文件包含漏洞。这使得未认证的攻击者能够在服务器上包含并执行任意文件，从而可以执行这些文件中的任意 PHP 代码。该漏洞可用于绕过访问控制、获取敏感数据，或在可以上传并包含图片及其他“安全”文件类型的情况下实现代码执行。 CVE: CVE-2025-2294 CVSS: 9.8（严重） 公开发布时间：...
CVE-2024-23897-Arbitrary-file-read
🤵🏻 CVE-2024-23897 Arbitrary-file-read 🤵🏻 Versiones afectadas: Jenkins 2.441 y anteriores. Jenkins LTS 2.426.2 y anteriores. Un script realizado en python para atumatizar la vulnerabilidad CVE-2024-23897 🤖 🛠️ Este código Python presenta un escáner para una vulnerabilidad específica CVE-2024-23897 en...
CVE-2026-12227
CVE-2026-12227 — LFI no autenticado en Visual Composer Website Builder PoC en Python 3 para CVE-2026-12227 Wordfence: Inclusión Local de Archivos a través del parámetro de consulta vcv-template en Visual Composer Website Builder visualcomposer en wordpress.org. | ---|--- Plataforma| Plugin de...
CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC
Apache CXF XOP Include 本地文件包含 CVE-2022-46364 概述 本仓库包含针对 CVE-2022-46364 的概念验证 PoC 利用程序，这是 Apache CXF 中的一个本地文件包含 LFI 漏洞。 该漏洞是由于 SOAP 请求中 XOP（XML 二进制优化打包）Include 元素处理不当引起的，允许攻击者读取服务器上的任意文件。 漏洞详情 CVE ID: CVE-2022-46364 组件: Apache CXF 漏洞类型: 本地文件包含 LFI 攻击向量: 远程（某些情况下无需认证） 影响: 服务器任意文件读取 根本原因 Apache CXF...
CVE-2025-68645-Exploiting-Zimbra-Webmail-LFI-Vulnerability
CVE-2025-68645 — Zimbra Classic UI LFI Defender Pack Este repositorio es un paquete de referencia centrado en la defensa para CVE-2025-68645 , un problema de inclusión de archivos locales LFI en Zimbra Collaboration ZCS 10.0.x y 10.1.x Classic Webmail UI causado por el manejo inadecuado de...
CVE-2026-71426: Improper Limitation of a Pathname to a Restricted Directory
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...
CVE-2021-27905.POC
CVE-2021-27905.POC POC para LFI relacionado con CVE-2021-27905 POC para apache-solr-file-read plantilla de nuclei Uso traverse.sh path Por ejemplo, usando /root como ruta, mostrará el contenido de todos los archivos recursivamente ./traverse.sh /root También es posible recorrer y obtener el...
CVE-2026-87902
CVE-2026-87902 — WordPress Core Path Traversal / LFI / RCE Inclusión Local de Archivos no autenticada mediante path traversal con doble codificación en el resolvedor de plantillas de página del núcleo de WordPress, con cadena de RCE basada en PEAR. Detalles de la Vulnerabilidad Campo| Valor ---|-...
CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
WordPress Simply Schedule Appointments plugin <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion vulnerability
Authenticated Subscriber+ Local File Inclusion vulnerability discovered by crow in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.27...
CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
CVE-2026-89294
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.12.27 . The root cause is the 'ssa_locale' parameter, which processes raw GET values without nonce or capability checks during the plugins_loaded action. While...
EUVD-2026-89654
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
CVE-2026-89294 Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
ElasticSearch <1.6.1 - Local File Inclusion
ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...
Metabase - Local File Inclusion
Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not...
SAP NetWeaver Application Server Java 7.5 - Local File Inclusion
SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...
