CVE-2022-29806

CVE-2022-29806 ZoneMinder bis 1.36.12 Sprach-Privilegieneskalation und RCE Beschreibung Eine Path Traversal-Schwachstelle in der Debug-Protokolldatei und der Standardsprachoption in ZoneMinder-Versionen vor 1.36.13 und 1.37.11 ermöglicht es Angreifern, beliebigen Code zu schreiben und auszuführen...

CVE-2026-81743 Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

EUVD-2026-67007

Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this configurable value, an administrator could set LOGFI...

CVE-2026-81743

Flowintel versions >=3.3.0 allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory. Because the application constructs the log destination from this value, an attacker with high privileges can set LOG_...

CVE-2026-46345

A flaw was found in compliance-trestle. The trestle author jinja command, when processing the -o/--output argument, is vulnerable to path traversal. This allows a local attacker to write files to arbitrary locations outside the intended workspace by providing specially crafted path sequences or...

The vulnerability of the iFlightDoc onboard documentation system, related to incorrect restrictions on the path name to the catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the iFlightDoc onboard documentation system is related to an incorrect limitation on the name of the path to the catalog h. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

CVE-2026-72814

A flaw was found in actix-files. When a non-existing folder is provided as the servefrom argument to Files::new, the service incorrectly resolves request paths as relative to the application's working directory. This allows an attacker to access unintended files, leading to information disclosure...

CVE-2026-73646

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

By-Poloss..-..CVE-2026-18080

CVE-2026-18080 — ERP Complete HR, Accounting & CRM Suite = 1.17.7 Nicht authentifizierter beliebiger Datei-Upload über CRM-E-Mail-Connect-IMAP-Anhang Path Traversal → RCE...

Ruby-On-Rails-Path-Traversal-Vulnerability-CVE-2018-3760-

Ruby On Rails Path Traversal-Schwachstelle（CVE-2018-3760） 中文版本Chinesische Version Ruby On Rails ist ein bekanntes Ruby-Webentwicklungsframework, das Sprockets als statischen Dateiserver in der Entwicklungsumgebung verwendet. Sprockets ist eine Ruby-Bibliothek, die statische Ressourcendateien...

CVE-2026-81560

blackms aistack versions up to 1.6.1 are affected by a path traversal vulnerability in the Static File Handler component (file src/web/server.ts). The root cause is improper handling of the req.url argument, which can be manipulated to access files outside the intended directory. The attack is re...

CVE-Arsenal-Lab

TomcatScanner Erweitertes Erkennungs- und Exploitationstool für CVE-2025-24813 TomcatScanner ist ein umfassendes Sicherheitstool zur Erkennung und Ausnutzung der Schwachstelle CVE-2025-24813 in Apache Tomcat-Servern. Diese Schwachstelle betrifft ein Problem der Pfadgleichheit im Parameter...

CVE-2026-26336-PoC

CVE-2026-26336 — Alfresco Share Unauthentifiziertes Dateilesen Überblick Alfresco Share stellt einen /share/page/resource/-Endpunkt bereit, der zum Ausliefern statischer Ressourcen verwendet wird. In verwundbaren Versionen schränkt dieser Endpunkt Pfad-Traversal nicht ordnungsgemäß ein, sodass ei...

CVE-2020-17519-Apache-Flink

CVE-2020-17519 Apache Flink Lecture arbitraire de fichiers Portée concernée Apache Flink 1.5.1 1.11.2 POC /jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd Utilisation du script python3 CVE-2020-17519 --help Affiche l'aide python3...

cve-2026-39440-funnelforms-fix

CVE-2026-39440 FunnelForms Fix Ein Drop-in-WordPress-Plugin, das den verwundbaren Demo-Import-Handler in FunnelForms Pro ≤ 3.8.1 blockiert, um Remote Code Execution CVE-2026-39440, CVSS 9.9 zu entschärfen. Die Schwachstelle...

CVE-2026-5027

CVE-2026-5027 - Langflow Path Traversal zu Remote Code Execution Beschreibung Langflow-Versionen bis einschließlich 1.8.4 bereinigen den Parameter filename im Endpunkt POST /api/v2/files nicht. Ein Angreifer kann Pfad-Traversal-Sequenzen ../ verwenden, um Dateien an beliebige Stellen im Dateisyst...

CVE-2020-29134

Totvs Fluig Plattform root@kitploit: Fluig ist die Produktivitäts- und Kollaborationsplattform, die in das ERP-System integriert, und in die anderen Systeme Ihres Unternehmens, um die Art und Weise, wie Sie und Ihr Team arbeiten, zu revolutionieren. CVE-2020-29134 root@kitploit: Die TOTVS Fluig...

CVE-2019-2615

CVE-2019-2615 GET /beawlsmanagementinternal2/wlmanagement HTTP/1.1 Host: 192.168.5.137:7001 User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:66.0 Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/ ;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encodin...

CVE-2025-55182

CVE-2025-55182 RCE स्वयं-उपयोग जांच उपकरण, CVE-2025-55182 भेद्यता की जांच के लिए भेद्यता सिद्धांत React Server Components में, सर्वर फ़ंक्शन एंडपॉइंट पर भेजे गए payload को डिकोड करते समय, पथ विश्लेषण में दोष है। यह कोलन द्वारा ऑब्जेक्ट गुणों को अलग करके नेस्टेड मान निकालता है जैसे: $1🅰️b का अर्थ...

CVE-2021-41773

CVE-2021-41773 Apache2 2.4.49 - Exploração de LFI & RCE Informações root@kitploit: Título do Exploit: Apache HTTP Server 2.4.49 - Path Traversal & Execução Remota de Código RCE Autor do Exploit: Gaurav Raj https://gauravraj.xyz https://blog.gauravraj.xyz Página do Fornecedor: https://apache.org/...