CVE-2026-57119

PraisonAI (a multi-agent LLM orchestration framework) is vulnerable to unauthenticated Local File Inclusion via the agent_file parameter in POST /api/v1/runs. Prior to 4.6.59 , the field accepts any absolute or traversing filesystem path without validation or allowlist, and the executor passes it...

CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI to RCE Ejecución remota de código no autenticada en Backup Migration plugin de WordPress. Ejecución root@kitploit: $ python exploit.py Se ejecuta el siguiente script PHP. root@kitploit: out.txt; ? Referencias Ejecución remota de código no autenticada crítica encontrada en el...

CVE-2018-12613

CVE-2018-12613 由于使用 %253f 字符绕过过滤器导致的本地文件包含漏洞。 受影响的软件 1. PHPMyAdmin v.4.8.0 2. PHPMyAdmin v.4.8.1 使用方法 此 PowerShell 脚本需要三个参数来构造一个利用 HTTP 请求： root@kitploit: 1. PHPMyAdmin URL 端点 2. 已认证用户的 Cookie 3. 要在远程服务器上获取的文件的完整路径 示例 准备所有参数以使用脚本： 然后，运行之后： 远程代码执行 如果你查询一个包含 PHP 代码的 SELECT SQL...

ExploitVelotiSmart

ExploitVelotiSmart Permite explotar la vulnerabilidad de LFI CVE-2018-14064 https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac https://www.exploit-db.com/exploits/45030/...

CVE-2025-47423

CVE-2025-47423 – Local File Inclusion in Personal Weather Station Dashboard 12lts Discovered by: Matthew Eagle Status: Public Disclosure Date Reported: 2025-05-05 CVE ID: CVE-2025-47423 🧩 Summary A Local File Inclusion LFI vulnerability in the Personal Weather Station Dashboard version 12lts allo...

WordPress True Ranker <2.2.4 - Local File Inclusion

WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file via local file inclusion. id: CVE-2021-39312 info: name: WordPress True Ranker 2.2...

Kodi 17.1 - Local File Inclusion

Kodi 17.1 is vulnerable to local file inclusion vulnerabilities because of insufficient validation of user input. id: CVE-2017-5982 info: name: Kodi 17.1 - Local File Inclusion author: 0xAkoko severity: high description: | Kodi 17.1 is vulnerable to local file inclusion vulnerabilities because of...

CAREL Boss Mini <= 1.4.0 - Local File Inclusion

Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access. id: CVE-2023-3643 info: name: CAREL Boss Mini = 1.4.0 - Local File Inclusion author:...

Jellyfin <10.7.0 - Local File Inclusion

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. id: CVE-2021-21402 info: name: Jellyfin 10.7.0 - Local File Inclusion author: dwisiswant0 severity: medium...

CVE-2020-1611

Juniper Junos Space 19.4R1之前版本的本地文件包含漏洞（CVE-2020-1611）（PoC） Juniper Junos Space 19.4R1之前版本存在一个本地文件包含漏洞。具有普通用户权限的攻击者可以利用此漏洞。 “下载报告”功能存在漏洞。 基础评分：6.5 向量：CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 链接： https://nvd.nist.gov/vuln/detail/CVE-2020-1611...

CVE-2025-69080

Gecko Theme LFI Exploit CVE-2025-69080 Unauthenticated Local File Inclusion LFI vulnerability in WordPress Gecko Theme = 1.9.8 ⚠️ Description This exploit targets a high-severity CVSS 8.1 Local File Inclusion vulnerability in the JanStudio Gecko WordPress theme. The vulnerability allows an...

CVE-2022-21371

CVE-2022-21371 Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Inclusión de Archivos Locales root@kitploit: Exploit Title: Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion Date: 25/1/2022 Exploit Author: Jonah Tan @picar0jsu...

CVE-2025-64714-privatebin-2.0.2-PoC

CVE-2025-64714 — Inclusión Local de Archivos en PrivateBin mediante Path Traversal en la Cookie de Plantilla Severidad: Media CVSS v3.1: 5.8 Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Versiones afectadas: PrivateBin = 1.7.7 Versión parcheada: 2.0.3 CWE: CWE-23 Path Traversal Relativo, CWE-73...

CVE-2025-68645

🛡️ CVE-2025-68645 - Zimbra 本地文件包含 LFI 分析 📌 概述 本文档描述了一个影响 Zimbra Collaboration Suite 的本地文件包含 LFI 漏洞。 该问题源于对以下参数的不当处理： root@kitploit: /h/?javax.servlet.include.servletpath= 这允许未经身份验证的用户访问内部应用程序资源。 🔍 漏洞详情 类型： 本地文件包含 LFI 访问权限： 无需身份验证 受影响组件： Webmail（经典界面） 攻击向量： HTTP 请求操纵 🧪 初始验证 测试请求： root@kitploit: cur...

CVE-2025-4524

CVE-2025-4524 WordPress Madara Theme 2.2.2.1 - Inclusión de Archivos Locales...

By-Poloss..-..CVE-2026-7515-PoC

CVE-2026-7515: BetterDocs Pro views-get"layouts/encyclopedia/$docstyle", 'doc' = $doc, 'excerpt' = $excerpt, 'dictionarylearnmoretext' = $learnmoretext, 'itemheadingtag' = $itemheadingtag, ; 问题： 变量 $docstyle（用户可控）被直接插值到传递给 views-get 的文件路径中，从而包含该文件。 数据流 root@kitploit: HTTP POST 请求 ↓ $POST'docstyle...

WordPress-News-and-Blog-Designer-Bundle-CVE-2025-14502

Informe de análisis de la vulnerabilidad CVE-2025-14502 Resumen de la vulnerabilidad Tipo de vulnerabilidad : Inclusión Local de Archivos Local File Inclusion, LFI Versiones afectadas : News and Blog Designer Bundle 1.1 y todas las versiones anteriores Severidad : Alta Complejidad del ataque : Ba...

CVE-2024-46987

CVE-2024-46987 - Camaleon CMS 本地文件包含 Camaleon CMS 的已验证本地文件包含（LFI）利用工具。 漏洞 Camaleon CMS 容易受到通过 /admin/media/downloadprivatefile 端点进行的已验证 LFI 攻击。file 参数未正确清理，允许路径遍历，从而读取服务器上的任意文件。 受影响版本 Camaleon CMS 2.8.2 环境要求 root@kitploit: pip install requests 使用方法 root@kitploit: Print file to terminal default...