OnlyOffice-path-traversal

ONLYOFFICE استغلال traversl المسار في CVE-2023-46988 📌 نظرة عامة يستغل هذا النص البرمجي ثغرة اجتياز المسار في ONLYOFFICE Document Server CVE-2023-46988 التي تسمح للمستخدمين غير المصرح لهم بنسخ ملفات تعسفية من الخادم. توجد الثغرة في نقطة النهاية /example/editor، حيث يمكن التلاعب بمعامل fileExt...

cve-2021-42013.get

Apache 2.4.50 - Обход пути или удаленное выполнение кода cve-2021-42013.py — это скрипт на Python, который помогает обнаружить уязвимость обхода пути или удаленного выполнения кода в Apache 2.4.50. Предоставляется уязвимый экземпляр Docker, чтобы вы могли попрактиковаться с CVE-2021-42013. Если...

cve-2021-42013L

cve-2021-42013 ثغرة اجتياز المسار في Apache 2.4.50 تابعنا يوتيوب تويتر تيليغرام Vulnmachines.com...

cve-2021-42013

Apache 2.4.50 - Path Traversal или Remote Code Execution cve-2021-42013.py — это скрипт на Python, который поможет найти уязвимость Path Traversal или Remote Code Execution в Apache 2.4.50. Уязвимый экземпляр Docker предоставлен, чтобы вы могли попрактиковаться в работе с CVE-2021-42013 Если...

CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

CVE-2026-106103

The Quasar Framework is vulnerable to a Path Traversal and Arbitrary File Write vulnerability in the @quasar/icongenie component prior to version 6.1.1 . The root cause is located in icongenie/lib/utils/get-assets-files.js and icongenie/lib/utils/validate-profile-object.js, where the icongenie ge...

CVE-2026-42048

CVE-2026-42048 CVE-2026-42048 Langflow اجتياز المسار / إثبات المفهوم لحذف الدليل التعسفي https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de الوصف CVE-2026-42048 : ثغرة حذف دليل تعسفي في Langflow الوصف: ثغرة اجتياز المسار في Langflow قبل الإصدار 1.9.0 تسمح لمهاجم مُوثَ...

esm-lfi-poc

esm.sh LFI PoC packages authorized security research Two th...

CVE-2024-0204

CVE-2024-0204: استعراض معمّق لثغرة تجاوز المصادقة في Fortra GoAnywhere MFT يحتوي هذا المستودع على استغلال إثبات المفهوم لثغرة تجاوز المصادقة CVE-2024-0204 المكتشفة في منتج GoAnywhere MFT من Fortra. تسمح الثغرة لمهاجم غير مصادق بإنشاء مستخدم إداري للتطبيق. الوصف في 4 ديسمبر 2023، نشرت Fortra نشرة...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-14532 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a Reader-role attacker to obtain version information that causes an uncaught...

CVE-2026-22356

CVE-2026-22356: Vulnérabilité de traversée de chemin dans Jetpack CRM et RCE Avertissement : Cet outil ne doit être utilisé que dans des environnements de test autorisés. L'utilisateur est entièrement responsable de toute utilisation illégale. 📥 Prérequis pip3 install requests urllib3 $ python3...

GHSA-6GW6-RV2G-25MG Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Impact When generating an API plugin manifest from an attacker-controlled or compromised OpenAPI description, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath into the manifest without validating that it is a safe package-relative file reference. An attacker can supply...

WordPress-Path-Traversal-CVE-2019-11447

Penetration Test Report WordPress Path Traversal - CVE-2019-11447 Document Information Item| Details ---|--- Document Title| Penetration Test Report - WordPress Path Traversal Client/Exam| HackTheBox Lab - CPTS Exercise 1 Date| August 22, 2026 Assessor| Fernando Viana Penetration Tester Assessmen...

CVE-2026-105795

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

Vulnerability-CVE-2025-64446-CVE-2025-58034

Simulation d'exploitation FortiWeb CVE-2025-64446 & CVE-2025-58034 Remarque : Ce document est uniquement destiné à des fins d'apprentissage et de recherche en sécurité. Ne pas l'utiliser pour attaquer un système sans autorisation. 1. Vue d'ensemble FortiWeb est un dispositif Web Application...

CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

EUVD-2026-93424

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...