CVE-2025-6218-POC

RARLAB WinRAR Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open...

CVE-2021-41773

CVE-2021-41773 exploit PoC with Docker setup. CD into the directory containing the Apache configuration and Dockerfile shared in repo. Building Image: docker build -t cve-2021-41773:1.0 . Running the Docker Image: docker run --rm -d -p 4444:80 cve-2021-41773:1.0 Note: You can also use Image ID...

CVE-2026-29519-Lucee-Reflected-XSS

CVE-2026-29519-Lucee-Reflected-XSS Proof of Concept for Reflected XSS in Lucee CFML CVE-2026-29519 Framework 0-Day: Reflected XSS in Lucee CFML URL Parsing Affects Enterprise Deployments Versions 5.3.1.95 to 7.x Discoverer: Fouad Milat lavado Date Discovered: December 6, 2025 CVE: CVE-2026-29519...

CVE-2021-41773

CVE-2021-41773 PoC — Apache HTTP Server Path Traversal Overview CVE-2021-41773 is a path traversal vulnerability affecting Apache HTTP Server 2.4.49. The vulnerability allows an attacker to access files outside the intended directory under specific configurations, particularly when directories ar...

CVE-2024-53677-Docker

CVE-2024-53677 - Apache Struts 2 Remote Code Execution Vulnerability RCE Reproduction Environment This repository provides a Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2. This vulnerability involves path traversal and allows for arbitrary code executio...

CVE-2006-3392

CVE-2006-3392 Description Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are...

CVE-2026-12243-NLTK-PoC

CVE-2026-12243 — NLTK Path Traversal Lab A small, reproducible Docker lab that contrasts the percent-encoded path traversal behavior in NLTK 3.9.4 with the corrected behavior in NLTK 3.10.0. The vulnerable version validates the resource name before URL decoding. The fixed payload...

wp-file-manager-0day

CVE-2020-25213 wp-file-manager 6.7 20th Aug 2020 Wordpress Plugin 0day elFinder vulnerability is a well-know vulnerability, my script only changes path to "/wp-content/plugins/wp-file-manager/". Stop requesting fixes in script or something else for me. RTFM... References:...

CVE-2025-4632_POC

Samsung MagicINFO 9 Server Exploit CVE-2025-4632 This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution RCE vulnerability in Samsung MagicINFO 9 Server versions prior to 21.1052. The vulnerability exists due to an improper limitation of a...

PT-2026-133491

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../...

PT-2026-133625

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2010-20125: DedeCMS: DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to requireonce. Attackers can supply path traversal sequences ../../ to include...

CVE-2026-116249: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file…

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "../ /.pgpass", set through the server dialog,...

CVE-2026-61738: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as...

PT-2026-133524

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search-find...

PT-2026-133523

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH INFO at an encoded NUL byte in parse http request. The XS parser URL-decodes the request path and measures the result with strlen, so PATH INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote...

CVE-2026-117183

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

PT-2026-133610

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as...

PT-2026-133614

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require once. Attackers can supply path traversal sequences ../../ to include...