CVE-2026-55073

WeasyPrint prior to 70.0 contains a url_fetcher bypass in two write_pdf() code paths. The xmp_metadata parameter in weasyprint/pdf/__init__.py calls select_source() without passing the document's fetcher, enabling arbitrary local file read with contents embedded verbatim in the output PDF. The st...

CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

CVE-2026-55073

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

EUVD-2026-77638

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

cve-2014-0521

CVE-2014-0521 Adobe Reader の脆弱性 このJavaScriptベースのAdobe Readerの脆弱性は、2014年5月13日にリリースされたバージョン11.0.07より前の、すべてのプラットフォーム上の全バージョンのAdobe Readerに影響を与えます。このバグはGábor Molnár氏によって発見され、2014年3月10日に報告されました。 勧告: CVE-2014-0521 Adobe Security Bulletin APSB14-15 プレゼンテーション: Camp++ 2014 English: 動画（近日公開）, スライド: html, p...

CVE-2023-45858

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files...

CVE-2023-45858

CVE-2023-45858 is a directory traversal vulnerability in Paessler PRTG versions prior to 23.4.88.1429 , allowing an unauthenticated, remote attacker to read local files. The CVSS v3.1 score is 8.6 (HIGH) with a changed scope and high confidentiality impact , while integrity and availability are u...

EUVD-2023-60668

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files...

CVE-2023-45858

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI 作者： 0xmid00 漏洞： MTOM 请求中通过 XOP:Include 实现 SSRF / 本地文件读取 影响： Apache CXF false test IT john 该利用工具会自动将其转换为 MTOM 格式——您无需手动操作。 示例 模式 1 — 自动检测所有可注入字段 root@kitploit: python3 exp...

CVE-2015-4495

CVE-2015-4495 CVE-2015-4495 / mfsa2015-78 用エクスプロイト 使い方 parsedirectorylisting 関数にロジックを追加してください。 使用方法 root@kitploit: $ git clone https://github.com/vincd/CVE-2015-4495.git $ cd CVE-2015-4495 $ python -m SimpleHTTPServer 次に、パッチ未適用の Firefox（バージョン 39.0.3）を開きます。/ の内容を含むポップアップが表示されるはずです。 クレジット...

Exploit for CVE-2026-85706

cve-2026-85706 Unauthenticated arbitrary local file read in G...

CVE-2025-13796-PoC

CVE-2025-13796-PoC deco-cx アプリケーション: パラメータ analyticsScript.ts AnalyticsScript サーバーサイドリクエストフォージェリ PoC : root@kitploit: curl --path-as-is -i -s -k -X $'GET' \ -H $'Host: x.x.x.x' \ $'http://x.x.x.x/live/invoke/website/loaders/analyticsScript.ts?url=file:///etc/passwd'...

CVE-2021-36750

CVE-2021-36749 关于 - 在Druid的摄入系统中，InputSource用于从特定数据源读取数据。然而，HTTP InputSource允许经过身份验证的用户以Druid服务器进程的权限从非预期的其他源（如本地文件系统）读取数据。当用户直接访问Druid时，这并非权限提升，因为Druid也提供了Local InputSource，允许相同级别的访问。但是，当用户通过一个允许指定HTTP InputSource但不允许Local InputSource的应用程序间接与Druid交互时，就会出现问题。在这种情况下，用户可以通过向HTTP...

CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — NLTK パストラバーサルラボ NLTK 3.9.4 のパーセントエンコードされたパストラバーサル動作と、NLTK 3.10.0 で修正された動作を対比する、小さく再現可能な Docker ラボです。 脆弱なバージョンは、URL デコード前にリソース名を検証します。固定ペイロード %2e%2e/%2e%2e/outside/lab-secret.txt はチェックを通過し、後で ../../outside/lab-secret.txt にデコードされ、設定された NLTK...

CVE-2024-55557

CVE-2024-55557 使用方法 root@kitploit: python3 exploit.py --local retrieve from local readable files python3 exploit.py default mode is remote 詳細 詳しくは CVE-2024-55557 - Weasis 4.5.1 をご覧ください。 POC https://github.com/user-attachments/assets/a3f64a58-7720-4f93-8bcc-9393d8afcb68...

CVE-2026-89260

MoguBlog through 6.2 is affected by an XML External Entity (XXE) injection in the unauthenticated WeChat callback endpoint at POST /wechat/wechatCheck . The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap() , which relies on an unhardened dom4j SAXReader without DTD ...

Exploit for CVE-2026-85706

cve-2026-85706 Unauthenticated arbitrary local file read in G...

CVE-2026-89242

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...