BloodHound-Tools

Che cos'è questo? Una raccolta di strumenti che si integrano con BloodHound. Bloodhound è lo standard de facto che sia le squadre di sicurezza blu che rosse usano per trovare percorsi di movimento laterale e escalation dei privilegi che possono potenzialmente essere sfruttati in un ambiente...

PoC-CVE-2025-52913

CVE-2025-52913 - Vulnerabilità di normalizzazione dei percorsi in MiCollab 📌 Panoramica Questo repository contiene una Proof of Concept PoC per CVE-2025-52913 , una vulnerabilità di normalizzazione dei percorsi che interessa Mitel MiCollab. Il problema consente ad attaccanti non autenticati di...

WinRAR-CVE-2025-8088-Path-Traversal-PoC

PoC لـ CVE-2025-8088: اجتياز المسار في WinRAR وصف الثغرة ☢️ CVE-2025-8088 CVSS 8.4 هي ثغرة اجتياز مسار في WinRAR ≤7.12 تسمح بوضع الملفات خارج مجلد فك الضغط عبر تدفقات البيانات البديلة ADS في أرشيف RAR. يتم استغلالها لتوصيل برمجيات خبيثة إلى مجلدات النظام مثل Startup...

best-CVE-2025-8088

CVE-2025-8088 Exploit WinRAR 🔓 Un exploit proof-of-concept per la vulnerabilità di WinRAR CVE-2025-8088 che colpisce le versioni 7.12 e inferiori. Questo strumento crea un archivio RAR malevolo che incorpora payload in Alternate Data Streams ADS con path traversal, potenzialmente portando...

CVE-2024-48990-PoC-Testing

CVE-2024-48990-PoC-Testing 🐍🔓 Dieses Repository enthält einen Proof of Concept PoC , um eine Schwachstelle imneedrestart-Programm zu demonstrieren, die den Python-Pfad nicht korrekt setzt, was zu potenzieller Rechteausweitung führt. Der PoC zeigt einen möglichen Weg zur Erlangung erhöhter...

CVE-2021-27905.POC

CVE-2021-27905.POC POC per LFI relativo a CVE-2021-27905 POC per apache-solr-file-read nuclei template Utilizzo traverse.sh percorso Ad esempio, usando /root come percorso, verrà mostrato il contenuto di tutti i file ricorsivamente ./traverse.sh /root È anche possibile attraversare e ottenere il...

BlueHound

BlueHound ist ein Open-Source-Tool, das Blue Teams dabei hilft, die Sicherheitsprobleme zu identifizieren, die wirklich zählen. Durch die Kombination von Informationen über Benutzerberechtigungen, Netzwerkzugriff und nicht behobene Schwachstellen zeigt BlueHound die Pfade auf, die Angreifer nehme...

CVE-2023-1177-PoC-reproduce

MLflow CVE-2023-1177 - PoC e Riproduzione Questo repository contiene il codice Proof-of-Concept PoC e le istruzioni per riprodurre la vulnerabilità Local File Inclusion LFI in MLflow, identificata come CVE-2023-1177. Informazioni sulla vulnerabilità: CVE ID: CVE-2023-1177 Tipo di vulnerabilità:...

CVE-2024-8963

CVE-2024-8963 Ivanti Cloud Services Appliance - Path Traversal Path Traversal in der Ivanti CSA vor 4.6 Patch 519 ermöglicht es einem entfernten, nicht authentifizierten Angreifer, auf eingeschränkte Funktionen zuzugreifen...

libreoffice-convert vulnerable to path traversal / arbitrary file write

Impact options.fileName is used to build a filesystem path path.jointempDir.name, fileName and the caller-supplied document buffer is written there, but fileName is never reduced to a base name. A fileName containing "../" escapes the temporary directory, so a caller can write arbitrary content t...

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write

NPM: libreoffice-convert vulnerable to path traversal / arbitrary file write vulnerability discovered by ? in WordPress Npm libreoffice-convert versions 1.8.2...

EUVD-2026-67161

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...

CVE-2026-81726

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

CVE-2026-81716

opensslencrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox.issafepath, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READFILES permission could read or write another plugin's directory that merely shares...

CVE-2025-53632

CVE-2025-53632 Questo repository contiene un exploit di CVE-2025-53632 che colpisce Chall-Manager !WARNING Il modo in cui Chall-Manager gestisce gli scenari, è ancora completamente sfruttabile senza lo zip slip: basta manomettere il binario pulumi dello scenario in modo che la successiva esecuzio...

CVE-2026-79653

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The...

CVE-2020-5421

Riproduzione della vulnerabilità di sicurezza di Spring CVE-2020-5421 Panoramica della vulnerabilità CVE-2020-5421 può aggirare la protezione contro gli attacchi RFD tramite il parametro di percorso jsessionid. La protezione precedente contro RFD è stata aggiunta per far fronte a CVE-2015-5211...

CVE-2026-59280

Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader. Spring Framework 7.0.0 - 7.0.8 Spring...

CVE-2026-40526

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...