CVE-2026-31156

CVE-2026-31156 OpenPLC-v3 में एक पथ इंजेक्शन भेद्यता है, जो प्रोग्राम द्वारा कमांड लाइन से पास किए गए फ़ाइल पथ मापदंडों पर कोई वैधता जाँच न करने से उत्पन्न होती है। हमलावर दुर्भावनापूर्ण पथ बनाकर किसी भी पढ़ने योग्य फ़ाइल को पढ़ सकते हैं, जिससे सूचना लीक होने का जोखिम होता है। भेद्यता प्रकार अनुच...

CVE-2018-11776

CVE-2018-11776 के लिए असुरक्षित डॉकर कंटेनर root@kitploit: docker pull bhdresh/cve-2018-11776:1.0 docker run -dit -p :8080:8080 bhdresh/cve-2018-11776:1.0 प्रमाण-अवधारणा प्रमाण-अवधारणा - 1 root@kitploit: Request : http://:8080/struts2-showcase-2.3.14/$333+333/help.action Result :...

CVE-2024-32019_poc

ndsudo के माध्यम से विशेषाधिकार वृद्धि Netdata स्थानीय शोषण यह Netdata के साथ बंडल की गई एक कमजोर ndsudo उपयोगिता का शोषण करके स्थानीय विशेषाधिकार वृद्धि करने का एक वैकल्पिक POC है। यह शोषण उपयोगकर्ता के PATH में एक स्क्रिप्ट जोड़कर एक अनुमत कमांड nvme को ndsudo द्वारा प्रतिस्थापित करके और इसे रू...

CVE-2025-48384-test

कमांड लाइन पुनः प्रस्तुत करें root@kitploit: git clone --recursive https://github.com/beishanxueyuan/CVE-2025-48384-test.git संशोधित Git रिपॉजिटरी को इंगित करें root@kitploit: git init repo git -C repo -c protocol.file.allow=always submodule add https://github.com/beishanxueyuan/CVE-2025-48384.gi...

llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection

CVE-2026-58116 — RCE de la WebUI LLaMA-Factory via trustremotecode Preuve de concept pour CVE-2026-58116 CVSS 9.8 Critique : exécution de code à distance dans LLaMA-Factory = v0.9.5. La WebUI de LLaMA-Factory encode en dur trustremotecode=True lors du chargement d'un modèle...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-5006

HashiCorp Vault and Vault Enterprise are vulnerable to privilege escalation via slash injection in templated policy paths . An authenticated attacker who can control an identity value referenced by a templated policy can embed / characters, which Vault interprets as additional path segments when ...

cve-2024-32002-poc

💥 CVE-2024-32002 – PoC d'injection de chemin de sous-module Git Motivation Pendant la résolution de la machine Compiled de la plateforme Hack The Box, j'ai rencontré un comportement curieux impliquant Git et les sous-modules. En creusant plus profondément, j'ai trouvé cet excellent article du...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

PT-2026-79498

Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description Arc Enterprise's Raft FSM Finite State Machine in the applyRegisterFile function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the...

evilarc

evilarc الغرض يتيح لك evilarc إنشاء ملف zip يحتوي على ملفات تتضمّن أحرف اجتياز الدليل directory traversal في مسارها المضمّن. تمنع معظم برامج الضغط التجارية مثل winzip وغيرها استخراج ملفات zip التي تحتوي ملفاتها المضمّنة على مسارات بأحرف اجتياز الدليل. غير أنّ العديد من مكتبات تطوير البرمجيات لا...

EUVD-2026-62198

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or...

EUVD-2026-61067

A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource CR, to specify an unvalidated image path. This lack of validation...

CVE-2026-66783

A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource CR, to specify an unvalidated image path. This lack of validation...

Linux Distros Unpatched Vulnerability : CVE-2026-56858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

GHSA-RP2P-6CMP-JXJ9 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

PT-2026-71020

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...

CVE-2026-71475

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...

EUVD-2026-56899

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL...

CVE-2026-71475

The CVE describes a vulnerability in insights-client for RHEL9 where a compromised spoke can inject an unencoded ClusterID into the Insights API URL path. Since the ClusterID is used directly in the request path without validation or URL encoding, authenticated requests can be redirected to unint...