Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion

A directory traversal vulnerability in jphone.php in the JPhone comjphone component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-3426 info: name: Joomla! Component Jphone 1.0...

Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion

Razer Sila Gaming Router 2.0.441api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files. id: CVE-2022-29014 info: name: Razer Sila Gaming Router 2.0.441api-2.0.418 - Local File Inclusion author: edoardottt severity: high description: Razer Sila Gaming...

Joomla! Component Jfeedback 1.2 - Local File Inclusion

A directory traversal vulnerability in the Ternaria Informatica Jfeedback! comjfeedback component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1478 info: name:...

f5scan

f5scan Escáner F5 BIG IP para CVE-2020-5902 por bt0 Más información sobre la vulnerabilidad: https://support.f5.com/csp/article/K52145254?sf235665517=1 Requisitos: python3+ shodan colorama urlopen pyOpenSSL $ pip3 install -r requirements Opciones root@kitploit: -h, --help muestra este mensaje de...

CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - Local File Inclusion Description : Customer Support System 1.0 is vulnerable to Local File Inclusion. An authenticated user has the capability to access and read PHP files from the operating system by exploiting a Local File Inclusion LFI vulnerability...

CVE-2019-14322

CVE-2019-14322 针对 faisalfs10x 漏洞利用的修改：CVE-2019-14322 概念验证：路径名到受限目录的限制不当（“路径遍历”） https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/ https://nvd.nist.gov/vuln/detail/CVE-2019-14322 描述 在 Pallets Werkzeug 0.15.4 及之前版本中发现了一个漏洞，已被评为严重级别。该漏洞影响 Windows 组件的 SharedDataMiddleware...

CVE-2021-41773

CVE-2021-41773 スキャナー このスクリプトは、Apache バージョン 2.4.29 におけるパストラバーサルおよびローカルファイルインクルージョンの脆弱性をテストします。このスクリプトはローカルファイルを返さず、Webサーバーをスキャンして脆弱かどうかを通知するだけです。 使い方: python3 cve-2021-41773-scanner.py IPv4 address...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

CVE-2026-49952

setup root@kitploit: pip3 install Pillow torch torchvision run root@kitploit: $ python3 exploit.py http://localhost/discuz5/ +----------------------------------------------------+ | Discuz! X5.0 Remote Code Execution Exploit by EgiX | +----------------------------------------------------+ + Getti...

CVE-2023-4698

CVE-2023-4698 usememos/memos 0.13.2 中的本地文件包含LFI漏洞 描述 今天，我想聚焦一项重大发现——在 usememos/memos 中识别出一个关键安全漏洞。该漏洞属于本地文件包含LFI类别，对运行版本低于 0.13.2 的 usememos/memos 系统构成严重威胁。此问题已被分配 CVE 标识符 CVE-2023–4698。在这篇博客中，我们将剖析此漏洞，理解其影响，并强调修复它的紧迫性。 理解 LFI 漏洞...

OA-tongda-RCE

OA-tongda-RCE | Office Anywhere网络智能办公系统 后台Getshell 无需身份认证 1. 任意文件上传漏洞 /ispirit/im/upload.php 2. 本地文件包含漏洞 /ispirit/interface/gateway.php 命令执行绕过： root@kitploit: exec"cmd /c ".$command; $stdout = $exec-StdOut; $stroutput = $stdout-ReadAll; echo $stroutput; ? GetWebshell root@kitploit: ?php $fp =...

citrix_adc_netscaler_lfi

citrixadcnetscalerlfiscan このMetasploit-Frameworkモジュールは、企業が最新のCitrix脆弱性（2020年7月8日開示）を確認するために使用できます。 CVE-2020-8193 CVE-2020-8195 CVE-2020-8196 2020年7月8日にDonny Maasland氏による公開レポートで、脆弱性がどのように悪用されるかが議論されました。 2020年7月10日時点で、RIFTは、この脆弱性を使用して脆弱なインスタンスから有効なVPNセッションを抽出できることを確認しています。 Twitterから詳細を読む： Citrix...

CVE-2024-34470

CVE-2024-34470 HSC Mailinspector 5.2.17-3 から 5.2.18 - Local File Inclusion...

CVE-2025-54236

Adobe Magento SessionReaper LFI PoC A simple Python proof-of-concept demonstrating the CVE-2025-54236 SessionReaper vulnerability affecting vulnerable Adobe Magento versions. Educational and authorized security testing only. Features Automatic target URL normalization Random formkey generation Fi...

CVE-2017-16651

CVE-2017-16651 Python implementation of Roundcube LFI CVE-2017-16651...

CVE-2025-2294

🚨 Kubio AI Page Builder = 2.5.1 - Unauthenticated Local File Inclusion 📝 Description The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via the kubiohybridthemeloadtemplate function. This makes it possible for...

CVE-2026-57119

PraisonAI (a multi-agent LLM orchestration framework) is vulnerable to unauthenticated Local File Inclusion via the agent_file parameter in POST /api/v1/runs. Prior to 4.6.59 , the field accepts any absolute or traversing filesystem path without validation or allowlist, and the executor passes it...

CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI to RCE Unauthenticated Remote Code Execution in Backup Migration WordPress Plugin. Run root@kitploit: $ python exploit.py The following PHP script is executed. root@kitploit: out.txt; ? References Critical Unauthenticated Remote Code Execution Found in Backup Migration Plugi...

CVE-2018-12613

CVE-2018-12613 Local file inclusion bug due to filter bypass using %253f character. Software Affected 1. PHPMyAdmin v.4.8.0 2. PHPMyAdmin v.4.8.1 How to use This PowerShell scripts need three parameters to craft a exploit HTTP request: root@kitploit: 1. PHPMyAdmin URL endpoint 2. Cookies for an...