CVE-2021-41773

CVE-2021-41773 Песочница Это небольшой Docker-рецепт для развертывания контейнера на основе Debian bookworm с экземпляром Apache HTTPd 2.4.49, уязвимым к CVE-2021-41773. CGI был явно включён, чтобы его можно было использовать для тестирования/проверки поведения раскрытия локальных файлов, а также...

CVE-2022-24716-2

CVE-2022-24716 Icinga Web 2는 오픈 소스 모니터링 웹 인터페이스, 프레임워크 및 명령줄 인터페이스입니다. 인증되지 않은 사용자는 웹 서버에서 사용자 접근 가능한 로컬 시스템 파일의 내용을 유출할 수 있으며, 여기에는 데이터베이스 자격 증명이 포함된 icingaweb2 구성 파일이 포함됩니다. 설치 사용법 CVE-2022-24716 실행 설치 CVE-2022-24716는 golang 이 필요하며, 다운로드는 다음 명령어를 사용하세요: root@kitploit: go install -v...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

Gotenberg < 8.34.0 - Local File Disclosure

Gotenberg before 8.34.0 allows SSRF and limited local file disclosure via its /forms/libreoffice/convert endpoint. When LibreOffice is used to convert user-uploaded DOCX files, external relationships within the document such as a:blip r:link TargetMode="External" can instruct LibreOffice to fetch...

Adobe Connect < 12.1.5 - Local File Disclosure

Adobe Connect versions 11.4.5 and earlier, 12.1.5 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not...

Cellinx NVT Web Server - Local File Disclosure

Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi. id: CVE-2023-23063 info: name: Cellinx NVT Web Server - Local File Disclosure author: daffainfo severity: high description: | Cellinx NVT v1.0.6.002b was discover...

CVE-2022-44268-ImageMagick-Vulnerable-Docker-Environment

CVE-2022-44268 ImageMagick 임의 로컬 파일 읽기 https://www.metabaseq.com/imagemagick-zero-days/ PoC CVE-2022-44268 ImageMagick Arbitrary File Read PoC를 기반으로 docker를 사용하여 취약점 테스트 환경을 만들었습니다. 사용법 root@kitploit: get image docker pull y1nglamore/cve202244268:latest you can also build from Dockerfile run...

CVE-2017-10617

CVE-2017-10616 и CVE-2017-10617 Эти две уязвимости затрагивают Juniper Contrail версии 2.2, 3.0, 3.1 и 3.2: Жестко заданные учетные данные CVE-2017-10616 Внешняя сущность XML CVE-2017-10617 Бюллетень безопасности вендора можно найти по адресу Juniper Security Alert JSA10819 2017-10. Уязвимый серв...

CVE-2025-12137

1 Вспомогательная функция для вызова REST API плагина с текущим nonce root@kitploit: async function iwpFetchpath, method='GET', body const nonce = window?.wpApiSettings?.nonce || jQuery?.ajaxSettings?.headers?.'X-WP-Nonce'; const res = await fetch$location.origin/wordpress/wp-json/iwp/v1$path,...

CVE-2026-9335-keras-hdf5-externallink

CVE-2026-9335 — Keras HDF5 ExternalLink によるローカルファイル内容の開示 2つの公開Keras API — keras.saving.KerasFileEditor と keras.saving.loadweights / model.loadweights — は、リンクタイプのチェックを行わずに でHDF5グループメンバーを読み取ります。h5py はインデックス時に / をするため、攻撃者が提供した のみを含む 、、または ファイルによって、 Keras はの内容を読み取ることになります。...

CVE-2022-0219

CVE-2022-0219 Jadx уязвим к неограниченному использованию внешних сущностей XML CWE-611 при экспорте вредоносного APK-файла с помощью опции -e, содержащего специально созданный AndroidManifest.xml / strings.xml, в gradle. Это может привести к раскрытию локальных файлов при использовании из...

CVE-2026-30039

CVE-2026-30039 CVE-2026-30039에 대한 보안 권고 자료로, rarfile의 심볼릭 링크 기반 아카이브 추출 문제이며 4.2 및 이전 버전에 영향을 미칩니다. English advisory | 中文版本 개요 rarfile은 공격자가 제어하는 RAR 아카이브에서 심볼릭 링크를 추출할 때, 포함된 심볼릭 링크 대상이 의도된 추출 디렉터리 내에 유지되는지 검증하지 않습니다. 따라서 제작된 아카이브는 절대 경로를 가리키거나 대상 디렉터리를 벗어나는 심볼릭 링크를 생성할 수 있습니다. 추출된 심볼릭 링크가 이후...

CVE-2024-58258

CVE‑2024‑58258 – SugarCRM SSRF и раскрытие локальных файлов О проекте Этот репозиторий содержит proof-of-concept для CVE‑2024‑58258 — уязвимости SugarCRM 13.0.4 / 14.0.1, при которой пользовательский ввод обрабатывается как LESS в API /css/preview, что позволяет неаутентифицированный SSRF или...

exploit-CVE-2019-14530

Эксплойт для OpenEMR CVE-2019-14530 OpenEMR --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder Filename of the file to be read Username of the admin Password of the admin --debug Display arguments -h, --help Show this screen Examples: exploit.rb...

CVE-2021-41773

CVE-2021-41773 실습 환경 이것은 Debian Bookworm 기반의 컨테이너에 CVE-2021-41773에 취약한 Apache HTTPd 2.4.49 인스턴스를 설정하기 위한 작은 Docker 레시피입니다. CGI가 명시적으로 활성화되어 있어 로컬 파일 노출 동작 및 원격 명령 실행 동작을 테스트/검증하는 데 사용할 수 있습니다. 사용법 root@kitploit: $ docker-compose build && docker-compose-up 로컬 파일 노출 root@kitploit: $ curl -s...

CVE-2023-39024-5-POC

CVE-2023-39024 e CVE-2023-39025 POC POC para CVE-2023-39024 e CVE-2023-39025 Harman Media Suite Visão Geral Aplicação Afetada: Harman Media Suite Versões Afetadas: 4.2.0 e anteriores Descrição: O Harman Media Suite versões 4.2.0 e inferiores é vulnerável a Server Side Request Forgery SSRF...

CVE-2026-19913

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated arbitrary file read vulnerability in the mwEmbedLoader.php endpoint. The ServiceUrl parameter accepts non-HTTP schemes such as file://; the KalturaClientBase PHP client fetches the data and passes it to unserialize() withou...

EUVD-2026-65615

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path through the Submodule.configparser path in git/objects/submodule/base.py. An attacker can disclose the first line of a readable...