CVE-2005-0603-phpBB-2.0.12-Full-path-disclosure

CVE: https://vulners.com/cve/CVE-2005-0603 Neo Security Team NST® - 安全公告 06 - 25/02/05 程序：phpBB 2.0.12 主页：http://www.phpbb.com 受影响版本：phpBB 2.0.12 及更低版本 风险：低风险!! 影响：完整路径泄露 -==phpBB 2.0.12 完整路径泄露==- 描述 phpBB 是一个高性能、完全可扩展且高度可定制的开源论坛软件包。phpBB...

CVE-2024-45440

CVE-2024-45440 Drupal CVE-2024-45440 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. 使用 python CVE-2024-45440.py 靶场部署 settings.php将通过挂载的方式替换掉容器中的settings.php...

wphunter

WPHunter 工具 ☣ WPHunter 是一款 WordPress 漏洞扫描器 您可以在自己的 WordPress 网站上使用此工具，通过查找漏洞来检查网站的安全性。 超过 7500 万个网站运行在 WordPress 上，如今它支撑着 26% 的 Web 内容。令人惊讶的是，每天有成千上万的 WP 网站存在漏洞并被黑客入侵。您可能会丢失所有数据，损失数千美元，更糟糕的是，攻击者可能利用您的 WordPress 来攻击您的访客。机器人会自动扫描网络寻找弱网站并快速入侵。如果您的 WordPress 存在漏洞，那么遇到麻烦只是时间问题。因此，您应该尽快开始检查自己的 WordPres...

Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

Drupal 11.x-dev - Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. id: CVE-2024-45440 info: name: Drupal 11.x-dev - Full Path Disclosure author: DhiyaneshDK severity: medium description: |...

CirCarLife <4.3 - Improper Authentication

CirCarLife before 4.3 is susceptible to improper authentication. An internal installation path disclosure exists due to the lack of authentication for /html/repository.System. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-16668 inf...

emlog 5.3.1 Path Disclosure

emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file. id: CVE-2021-3293 info: name: emlog 5.3.1 Path Disclosure author: h1ei1 severity: medium description: emlog v5.3.1 is susceptible to full path disclosure via...

WP Popups - Information Disclosure

WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions. id: CVE-2024-6555 info: name: WP Popups - Informatio...

Campaign Monitor for WordPress - Information Disclosure

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...

WPintel

功能 • 安装 • 使用 • 许可证 • 下载 视频演示 功能 检测 WordPress 版本 检测版本漏洞 枚举用户 检测主题 检测插件 查找完整路径泄露 检查用户注册状态 安装 Google Chrome 用户可以从 Chrome 网上应用店下载 WPintel 如何使用？ 理解图标颜色 使用 WPintel 非常简单。添加 WPintel 后，你可以通过 WPintel 图标的颜色来判断一个网站是否使用了 WordPress。 扫描菜单 当图标颜色变为绿色时，点击它，你将看到以下选项屏幕，点击所需的扫描即可完成。 更改目标 你可以直接在 WPintel...

CVE-2026-105748

The Docling library (versions 2.16.0 through 2.131.0 ) is vulnerable because the InputFormat.JSON_DOCLING backend fails to reject picture image references containing local paths or file URIs during serialized DoclingDocument input validation. When processing with ImageRefMode.EMBEDDED , the Docli...

CVE-2024-5735

CVE-2024-5735 AdmirorFrames Joomla! Extension params'templatesBASE' = JPATHBASE . DIRECTORYSEPARATOR . 'plugins' . DIRECTORYSEPARATOR . 'content' . $path . 'templates' . DIRECTORYSEPARATOR; Este problema fue causado por el uso directo de la variable JPATHBASE al construir la ruta de la imagen. Es...

CVE-2024-45440

Herramienta de enumeración para CVE-2024-45440 por DividesByZer0 & c0d3Ninja CVE-2024-45440 - PoC de Divulgación de Ruta Completa en Drupal 11.x-dev opciones: -h, --help muestra este mensaje de ayuda y sale -u URL, --url URL URL única para escanear. -f FILE, --file FILE Archivo que contiene URLs...

CVE-2001-0934

CVE-2001-0934 Cooolsoft PowerFTP Server 2.03 允许远程攻击者通过 pwd 命令获取服务器根目录的物理路径，该命令会列出完整路径名。 Securiteam 发布在 http://www.securiteam.com/exploits/6D00L2A35K.html 外部信息在 https://marc.info/?l=bugtraq&m=100698397818175&w=2 Cisco 参考在 https://tools.cisco.com/security/center/viewAlert.x?alertId=2884 作者 Alex...

CVE-2026-37069

CVE-2026-37069 Divulgación de Ruta Absoluta en /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php en Veno File Manager Project 4.4.9 permite a un atacante no autenticado conocer en qué directorio del sistema se está ejecutando el código de la aplicación enviando una petició...

DedeCMS 5.7 - Path Disclosure

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php id: CVE-2018-6910 info: name: DedeCMS 5.7 - Path Disclosure author: pikpikcu severity: high description: DedeCMS 5.7 allows remote attackers to discover t...

CouchCMS <= 2.0 - Path Disclosure

CouchCMS = 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. id: CVE-2018-7662 info: name: CouchCMS = 2.0 - Path Disclosure author: ritikchaddha severity: medium description: CouchCMS = 2.0 allows...

CVE-2025-6082

CVE-2025-6082 全路径泄露 PoC 作者 : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-6082 漏洞 : 全路径泄露 CWE-200 描述 本概念验证利用 Birth Chart Compatibility WordPress 插件（版本 ≤ 2.0）中的全路径泄露漏洞。PoC 向插件的 index.php 端点发送 HTTP GET 请求，捕获任何 PHP 警告或致命错误，并解析出服务器的文件系统路径（例如 /var/www/html/wp-content/plugins/... 或...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2025:1739822224)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739822224 advisory. - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of...

CVE-2026-100854

AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...