CVE-2020-29134

Totvs Fluig 플랫폼 Fluig는 ERP 시스템 및 회사의 다른 시스템과 통합되어 사용자와 팀이 일하는 방식을 혁신하는 생산성 및 협업 플랫폼입니다. CVE-2020-29134 TOTVS Fluig 플랫폼은 base64로 인코딩된 매개변수를 통한 경로 탐색을 허용합니다. 이 취약점이 악용되면 데이터베이스에 접근하기 위한 데이터가 포함된 민감한 XML 파일을 읽을 수 있으며, 경우에 따라 LDAP 연결 및 ERP 시스템 통합 데이터도 읽을 수 있습니다. 또한 /etc/passwd 및 /root/.bashhistory와 같...

CVE-2025-25279

Security Advisory MMSA-2025-00430 / CVE-2025-25279 Summary After uploading a file to Mattermost Boards, when the fileId parameter is modified and the board is copied, the file now points to and downloads the target file specified in the parameter. Affected Versions: Mattermost instances with Boar...

CVE-2024-32019-ndsudo

The ndsudo vulnerability allows an attacker to gain root permissions by exploiting an untrusted search path in the ndsudo tool, which is part of the Netdata Agent. This can enable the execution of arbitrary programs with elevated privileges if the attacker places a malicious binary in a writable...

EUVD-2026-94758

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

CVE-2026-5049

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

CVE-2026-5049

A path traversal vulnerability exists in the Zone Alias Import flow feature of the HPE B-Series SANnav Management Portal (prior to versions 3.0.0a and 3.0.1 ) and Brocade SANnav (before 3.0.0a ). A local authenticated attacker can exploit this flaw to write uploaded content outside the intended d...

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal

WordPress-File-Upload-4.24.11---Unauthenticated-Path-Traversal CVE-2024-9047 A Python-based security tool to detect and exploit an arbitrary file read vulnerability in the WordPress WP File Upload plugin versions = 4.24.11...

CVE-2024-32113-POC

Apache OfBiz 취약점 CVE-2024-32113 POC USERNAME 및 PASSWORD 매개변수는 누구나 접근 가능한 /ecomseo/AnonContactus 인터페이스에서 제공할 수 있습니다. POC1: RCE curl --noproxy '' -k --location --request POST 'https://127.0.0.1:8443/xxx/yyy/zzz/../../../%2e/webtools/control/ProgramExport' \ --header 'User-Agent: Apifox/1.0.0...

zip4j

zip4j This repository contains decompiled source code for the zip4j library versions 1.3.2 vulnerable and 1.3.3 fixed for CVE-2018-1002202, for the CWE-Bench-Java dataset. The original zip4j repository on Github doesn't include code from these versions. Versions Version 1.3.2 Vulnerable Tag : 1.3...

CVE-2023-33404

CVE-2023-33404 A user who has EditOwnPosts right on BlogEngine.NET CMS version 3.3.8.0 and earlier has the ability to upload a malicious file to a hard-coded location. POST request to /api/upload endpoint with "action=video" parameters, as shown in the screenshot below, triggers a file upload...

CVE-2019-5418

CVE-2019-5418 테스트 케이스 실행: $ rails s PoC: Accept: ../../../../../../../../etc/passwd Req 1 - GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept: diyarbakirguzelbaglardelalelorke ------ 잡기 Content-Length: 306...

CVE-2024-34470

HSC MailInspector - CVE-2024-34470 HSC Mailinspector 버전 5.2.18 이하에서 심각한 취약점이 발견되었습니다. 이 취약점은 /public/loader.php 파일의 알려지지 않은 기능에 영향을 미칩니다. 알 수 없는 입력으로 'path' 인수를 조작하면 경로 탐색path traversal 취약점이 발생합니다. CWE에 따르면 이 문제는 CWE-22로 분류됩니다. 제품은 제한된 상위 디렉터리 아래에 있는 파일이나 디렉터리를 식별하기 위해 외부 입력을 사용하여 경로명을 구성하지만, 경로명...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile Arbitrary File Write via Path Traversal CVE-2025-4517 CVSS 9.4 – Critical A vulnerability in Python's tarfile module that allows arbitrary file writes outside the extraction directory when using TarFile.extractall or TarFile.extract with filter="data" or...

CVE-2022-37122-Exploit

CVE-2022-37122 Path Traversal Scanner A robust and feature-rich scanner for detecting the Carel pCOWeb logdownload.cgi path traversal vulnerability CVE-2022-37122. Designed for security researchers and authorized penetration testers. 🚨 Important Notice EDUCATIONAL / BUG BOUNTY USE ONLY This tool ...

CVE-2025-8110

Gogs RCE Exploit CVE-2025-8110 A Proof of Concept PoC for CVE-2025-8110 , a critical vulnerability in Gogs that allows Remote Code Execution RCE via .git/config manipulation using symbolic link bypasses and sshCommand injection. 📖 Overview This exploit targets a Path Traversal flaw in the Gogs AP...

day03-jenkins-23897

Day 3 — Jenkins CLI arbitrary file read CVE-2024-23897 Idea: Jenkins ≤ 2.441 LTS ≤ 2.426.2 expands @/path inside CLI args. Unauthenticated users can make Jenkins read local files and reflect their first lines via the CLI help output. Fixed in 2.442 / 2.426.3. Build → Run 1 Build docker build -t...

CVE-2024-34470

CVE-2024-34470 Description: An Unauthenticated user can abuse Path Traversal vulnerability exists in the /public/loader.php file. The path parameter does not properly filter whether the file and directory passed are part of the webroot, allowing an attacker to read arbitrary files on the server...

CVE-2015-3337

CVE-2015-3337 CVE-2015-3337 Arbitrary File Read http://10.10.20.166:9200/plugin/head/../../../../../../../../../etc/passwd Usage: python CVE-2015-3337.py python CVE-2015-3337.py / \ | | | | / | |/ | | | | || || || / | / / | | | | ' / /'| |/' || | | \ / / / / / / / / | | | | | | || / / | /| | | |...

CVE-2024-32113

CVE-2024-32113 Apache OFBiz 경로 탐색으로 인한 RCE 익스플로잇. Apache OFBiz에는 제한된 디렉터리의 경로명을 제대로 제한하지 못하는'경로 탐색' 취약점이 존재합니다. 이 문제는 18.12.14미포함 이전 버전의 Apache OFBiz에 영향을 줍니다. 사용자는 이 문제를 해결한 버전 18.12.14 로 업그레이드하는 것이 권장됩니다. fofa 쿼리 app="ApacheOFBiz" POC POST /webtools/control/forgotPassword;/ProgramExport HTTP/1....

CVE-2020-3452-Cisco-Python-Scanner

CVE-2020-3452 Scanner A safe, non-destructive Python scanner for Cisco ASA / FTD WebVPN Directory Traversal CVE-2020-3452. CVE-2020-3452 is a critical unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files on the Cisco ASA or FTD device. Overview This to...