CVE-2026-3288-lab

CVE-2026-3288 Vulnerable Lab Docker NGINX Ingress Controller Configuration Injection ⚠️ ПРЕДУПРЕЖДЕНИЕ : Эта лаборатория содержит намеренно уязвимые конфигурации ТОЛЬКО ДЛЯ АВТОРИЗОВАННОГО ОБУЧЕНИЯ ПО БЕЗОПАСНОСТИ Обзор уязвимости CVE-2026-3288 CVSS 8.8 HIGH — инъекция конфигурации в NGINX Ingress...

CVE-2025-48384-test

Командная строка воспроизведения root@kitploit: git clone --recursive https://github.com/beishanxueyuan/CVE-2025-48384-test.git Изменение указанного GitHub-репозитория root@kitploit: git init repo git -C repo -c protocol.file.allow=always submodule add...

CVE-2018-11776

Conteneur Docker vulnérable pour CVE-2018-11776 root@kitploit: docker pull bhdresh/cve-2018-11776:1.0 docker run -dit -p :8080:8080 bhdresh/cve-2018-11776:1.0 PoC PoC - 1 root@kitploit: Request : http://:8080/struts2-showcase-2.3.14/$333+333/help.action Result :...

EUVD-2026-42742

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content...

CVE-2024-32019_poc

Повышение привилегий через ndsudo локальный эксплойт Netdata Это альтернативный POC для эксплуатации уязвимой утилиты ndsudo, входящей в состав Netdata, с целью локального повышения привилегий. Эксплойт работает путём добавления скрипта в PATH пользователя, подменяя разрешённую команду nvme для...

cve-2024-32002-poc

💥 CVE-2024-32002 – PoC внедрения пути Git подмодуля Мотивация При решении машины Compiled на платформе Hack The Box я столкнулся с любопытным поведением, связанным с Git и подмодулями. При более глубоком исследовании я нашел эту отличную статью исследователя Амала Мурали, в которой подробно...

CVE-2026-31156

CVE-2026-31156 OpenPLC-v3에는 명령줄에서 전달된 파일 경로 매개변수에 대한 유효성 검사를 수행하지 않아 발생하는 경로 주입 취약점이 있습니다. 공격자는 악성 경로를 구성하여 읽을 수 있는 모든 파일을 읽을 수 있으며, 정보 유출 위험이 있습니다. Vulnerability Type 잘못된 입력 검증 경로 주입 정보 공개 임의 파일 읽기 Vulnerability Overview gluegenerator.cpp에서 컴파일된 바이너리 프로그램에는 사용자가 제공한 파일 경로에 대한 검증 부족으로 인한 임의 파일 읽기...

llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection

CVE-2026-58116 — LLaMA-Factory WebUI RCE trustremotecode를 통한 CVE-2026-58116 CVSS 9.8 심각에 대한 개념 증명: LLaMA-Factory = v0.9.5에서의 원격 코드 실행. LLaMA-Factory WebUI는 모델 로드 시 trustremotecode=True를 하드코딩합니다 src/llamafactory/webui/chatter.py:139 및 runner.py:175,320. 공격자가 제어하는 "Model path" 필드는 검증되지 않은 상태로...

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

CVE-2026-77846

ash-project ash_sqlite versions from 0.1.2-rc.0 before 0.2.18 contain a JSON-path injection in AshSqlite.SqlImplementation. The json_extract path is built by concatenating "$." with Enum.join(right, "."), so a single get_path/2 segment containing ., [, ], or $ re-interprets the JSON path (e.g., "...

CVE-2026-77846 JSON path injection via unescaped get_path segments in AshSqlite

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation buil...

evilarc

evilarc Zweck Mit evilarc können Sie eine ZIP-Datei erstellen, die Dateien mit Directory-Traversal-Zeichen in ihrem eingebetteten Pfad enthält. Die meisten kommerziellen ZIP-Programme winzip usw. verhindern die Extraktion von ZIP-Dateien, deren eingebettete Dateien Pfade mit...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path via the TagReference.create function in git/refs/tag.py. An attacker can read local files by supplying a positional reference val...

CVE-2026-78680

NLTK versions before 3.10.3 fail to use validated absolute paths when invoking the Graphviz dot binary in dependencygraph.dot2img and AlignedSent.reprsvg, allowing attackers to execute arbitrary code by placing a malicious dot binary in the search path or current working directory. Attackers can...

CVE-2026-5006

HashiCorp Vault and Vault Enterprise are vulnerable to privilege escalation via slash injection in templated policy paths . An authenticated attacker who can control an identity value referenced by a templated policy can embed / characters, which Vault interprets as additional path segments when ...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

PT-2026-79498

Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description Arc Enterprise's Raft FSM Finite State Machine in the applyRegisterFile function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the...

EUVD-2026-62198

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or...