EUVD-2026-67291

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

EUVD-2026-67327

The static resource interface /api/static/deployKey/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root...

CVE-2024-25600-mass

carregamento em massa de shell para cve root@kitploit: python3 exploit.py -l yourlist.txt caminho da shell root@kitploit: https://examplewebsite.com/asd.php...

CVE-2026-81845

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function importsession/exportsession of the file mcpsequentialthinking/server.py of the component Import Session/Export Session. Such manipulation of the argument filepath leads to path traversal. It ...

CVE-2026-81847

A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function savepipeline/loadpipeline of the file pipelinetools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been made public and coul...

CVE-2026-81837

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-75337

The static resource interface /api/static/deployKey/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root...

CVE-2026-54083

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-53571

CVE-2026-53571 CVE-2026-53571 server.fs.deny Umgehung auf Windows alternativen Pfaden PoC. Der Inhalt von Dateien, die durch server.fs.deny festgelegt sind, kann im Browser unter Windows zurückgegeben werden. root@kitploit: mkdir CVE-2026-53571 cd CVE-2026-53571 npm init -y npm install...

CVE-2024-6473-PoC

CVE-2024-6473 PoC Yandex Browser für den Desktop vor 24.7.1.380 hat eine DLL-Hijacking -Sicherheitslücke, da ein nicht vertrauenswürdiger Suchpfad verwendet wird. Anfällige Browserversion !IMPORTANT Das Internet muss während der Installation ausgeschaltet sein, da der Browser sonst aktualisiert...

CVE-2021-42013

CVE-2021-42013 Verwundbarer Dienst Installation Mehrere Optionen: 1. Docker-Container root@kitploit: docker run -d -p 8080:80 12345qwert123456/apache2450cve-2021-42013 2. Dockerfile root@kitploit: git clone https://github.com/12345qwert123456/CVE-2021-42013.git cd...

CVE-2021-41773

CVE-2021-41773 Verletzlicher Dienst Installation Mehrere Optionen: 1. Docker-Container root@kitploit: docker run -d -p 8080:80 12345qwert123456/apache2449cve-2021-41773 2. Dockerfile root@kitploit: git clone https://github.com/12345qwert123456/CVE-2021-41773.git cd...

CVE-2025-0108

CVE-2025-0108 — Segurança Web PoC e Correção Este repositório contém um pequeno ambiente de laboratório para reproduzir e mitigar o problema CVE-2025-0108 confusão de caminho / contrabando de cabeçalhos entre Nginx e Apache. O objetivo da tarefa é demonstrar como requisições duplamente codificada...

cve-2021-41773-checker

🛑 CVE-2021-41773 Verificatore CVE-2021-41773 Verificatore è uno strumento CLI basato su Python che controlla se un server web di destinazione è vulnerabile alla vulnerabilità di path traversal di Apache che colpisce Apache HTTP Server 2.4.49. È progettato come un proof of concept a scopo didattic...

PT-2026-83128

file picker aka flutter file picker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAY NAME obtained from ContentResolver.query directly in file path construction without...

PT-2026-83283

Name of the Vulnerable Software and Affected Versions Hermes Agent version 0.16.0 Description An improper path restriction exists that allows attackers who can influence ingested message content to overwrite the credential store. This occurs by bypassing sensitive-path guards that failed to exclu...

EUVD-2026-67771

filepicker aka flutterfilepicker for Flutter, all versions through 10.3.10, is vulnerable to path traversal CWE-22 in its Android implementation. The openFileStream method in FileUtils.kt uses the DISPLAYNAME obtained from ContentResolver.query directly in file path construction without...

CVE-2026-38093

file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10 , contains a path traversal (CWE-22) vulnerability in its Android implementation. The openFileStream() method in FileUtils.kt uses the DISPLAY_NAME value returned by ContentResolver.query() directly in file path const...

PT-2026-82871

The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the...

VulnCheck KEV: CVE-2026-78003

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...