CVE-2026-7020

CVE-2026-7020 Ollama arbitrary file read via tensor digest path traversal. Exfiltrates SSH host keys and any other file from a reachable Ollama host in three unauthenticated API calls. Writeup: Co-Researcher @gouldnicholas Usage python3 poc.py Tries all three SSH host key types with known sizes a...

CVE-2021-41773

RCE exploit both for Apache 2.4.49 CVE-2021-41773 and 2.4.50 CVE-2021-42013: IMHO only "special" setups will be vulnerable to this RCE. Same happens for the "arbitrary file read" exploits you have seen. Both CVEs are indeed almost the same path-traversal vulnerability 2nd one is the uncomplete fi...

CVE-2018-11235

PoC exploit for CVE-2018-11235 GitHub is not allowing me to push a repository exploiting the vulnerability good point for them, so you will have to build it yourself by running the build.sh script. Then, push the repository somewhere. When you clone it with the --recurse-submodules flag, the evil...

CVE-2020-17519-Apache-Flink

CVE-2020-17519 Apache Flink Arbitrary File Read Affected Versions Apache Flink 1.5.1 1.11.2 POC /jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd Usage python3 CVE-2020-17519 --help View usage help python3 CVE-2020-17519 -u...

CVE-2021-43798

usage: grafana-exploit.py -h -H/--host HOST grafana-exploit.py: error: the following arguments are required: -H/--host example: python3 grafana-exploit.py --host if successfuly read arbitary-file situation show the request URL and curl command +RequestURL...

CVE-2021-27905.POC

CVE-2021-27905.POC POC for LFI related to CVE-2021-27905 POC for apache-solr-file-read nuclei template Use traverse.sh path For example, using /root as path, will display the content of all files recursively ./traverse.sh /root It's also possible to traverse and get the content of every file on t...

k8s-CVE-2021-43557-poc

Installation install minikube install apisix: helm repo add apisix https://charts.apiseven.com helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update kubectl create ns ingress-apisix helm install apisix apisix/apisix \ --set gateway.type=NodePort \ --set...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: unauthenticated path traversal in page-template resolution Unauthenticated local PHP file inclusion in WordPress Core via a double-encoded pagename value — and, under specific deployment conditions, PHP code execution with the web-server account's privileges. |...

CVE-2025-60423

Authentication Bypass: 7.2.8 This authentication bypass is similar to Shiro's permission bypass. In the dofilterInternal method of the sessionfilter class, the default dofilter parameter is true, and only when it is false can authentication be bypassed. Following into the matches method, this cod...

CVE-2024-0204

CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive This repository contains a proof-of-concept exploit for the authentication bypass vulnerability CVE-2024-0204 discovered in Fortra's GoAnywhere MFT product. The vulnerability allows an unauthenticated attacker to create an...

CVE-2026-49009

▄█████ ██ ██ ██████ ████▄ ▄██▄ ████▄ ▄██▀▀▀ ██ ██ ▄█▀▀█▄ ▄██▄ ▄██▄ ▄█▀▀█▄ ██ ██▄▄██ ██▄▄ ▄▄▄ ▄██▀ ██ ██ ▄██▀ ██▄▄▄ ▄▄▄ ▀█████ ▀▀▀██ ██ ██ ██ ██ ▀▀▀██ ▀█████ ▀██▀ ██▄▄▄▄ ███▄▄ ▀██▀ ███▄▄ ▀█▄▄█▀ ██ ▄▄██▀ ▀██▀ ▀██▀ ▄▄██▀ ░█▄█░█▀▀░█▀█░█▀▄░█▀▀░█▀▄░░░█▀▀░█▀▀░█▀▄░█░█░█▀▀░█▀▄░░░█▀▄░█▀▀░█▀▀░...

CVE-2026-50181

CVE-2026-50181 Langroid path traversal in file tools allowed read/write outside the configured current directory. Primary advisory: GHSA-fg23-3346-88f5 GitHub advisory database: github.com/advisories/GHSA-fg23-3346-88f5 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE|...

CVE-2021-41773

CVE-2021-41773 Fast python tool to test apache path traversal CVE-2021-41773 in a List of url Usage :- create a live urls file and use the flag "-l" python3 apachepathtraversal.py -l urls-list.txt...

CodePath_Week_7-8

CodePath Week 7-8 CodePath Assignment for Weeks 7 & 8: CVE-2017-14719, CVE-2019-9787 & Unauthenticated Page/Post Content Modification via REST API Project 7 - WordPress Pentesting Time spent: 16 hours spent in total Objective: Find, analyze, recreate, and document vulnerabilities affecting an old...

OnlyOffice-path-traversal

ONLYOFFICE Path Traversal Exploit CVE-2023-46988 📌 Overview This script exploits a path traversal vulnerability in ONLYOFFICE Document Server CVE-2023-46988 that allows unauthorized users to copy arbitrary files from the server. The vulnerability exists in the /example/editor endpoint, where the...

CVE-2021-41773-PoC

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 This script test Apache HTTP Server 2.4.49 Usage: CVE-2021-41773.py options Only for one IP: python CVE-2021-41773.py IPaddress Option -f For IP list in file Example: python CVE-2021-41773.py -f...

LabAutomationCVE-2021-43798

LabAutomationCVE-2021-43798 I make a script for pentest automation where i exploit CVE-2021-43798 a path traversal on Grafana to steal user secrets SSH key and then gain privileges on a Linux system using SUID. I automate this lab to share the pentest methodology...

CVE-2026-34070

I Found a Path Traversal Bug in LangChain That Could Leak Your Cloud Credentials How a forgotten legacy API in one of AI's most popular frameworks quietly exposed millions of applications to arbitrary file reads. There's a certain feeling you get when a proof-of-concept works on the first try. No...

CVE-2016-20104

The EyeLock nano NXT versions 3.05.1193 , 3.04.1108 , 3.03.944 , and 3.01.646 are vulnerable to a path traversal vulnerability in the /scripts/logdownload.php script. The root cause is the unvalidated use of the 'path' parameter within the readfile() function, which allows unauthenticated attacke...

EUVD-2016-10921

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd,...