vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

cynative

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Built-in agents · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning throu...

CVE-2023-41993

CVE-2023-41993 Exploit PoC This repository contains a Proof of Concept PoC exploit for the CVE-2023-41993 vulnerability. This PoC demonstrates limited read/write primitives based on the PoC released by po6ix. Demo of this PoC can be found here. Please make an issue if you have any questions,...

vvdecapp Component Buffer Overflow DoS

The vulnerability of the setBufferingPeriodSEI function in the vvdecapp VVdeC component is related to reading data beyond the buffer’s capacity. Exploiting this vulnerability could allow an attacker to cause a service failure or gain access to protected information...

Enlogic SCADA Virtual Controller Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files...

RawHive

RawHive RawHive is a Cobalt Strike BOF for pulling selected Windows registry hives straight from a raw NTFS volume. It skips the normal file APIs, walks NTFS metadata to find the target file records, and reads the bytes directly from disk. Targets: C:\Windows\System32\config\SAM...

CVE-2026-77372

A flaw was found in VeraCrypt. The deserialization routines responsible for processing messages sent from unprivileged user interfaces to the elevated root service fail to properly validate data lengths and element counts. A local attacker can exploit this flaw by sending specially crafted...

Eclipse Mojarra - Local File Read

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. id: CVE-2020-6950 info: name: Eclipse Mojarra - Local File Read author: iamnoooob,pdresearch severity: medium description: | Directory traversal in Eclipse Mojarra...

GravitLauncher LaunchServer <=5.7.11 - Unauthenticated Path Traversal to Arbitrary File Read

LaunchServer's Netty FileServerHandler computes the served path by stripping one leading character on the assumption that every request-target begins with '/'. Netty's HttpServerCodec accepts a request-target without a leading slash verbatim, so a request without a leading slash bypasses path...

Eclipse Theia - Unauthenticated Path Traversal

Eclipse Theia's plugin-ext backend exposes the hostedPlugin endpoint without constraining the resolved path to the plugin directory. An unauthenticated request using encoded traversal sequences can therefore read files accessible to the backend process. The built-in vscodebat plugin identifier...

esm.sh <= v136 - Local File Inclusion

esm.sh = 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request. id: CVE-2025-59341 info: name: esm.sh = v136 - Local File Inclusion author: 0xAkoko severity: high description:...

Mitel MiCollab - Arbitary File Read

The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attack...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

System Dashboard < 2.8.15 - Admin+ Path Traversal

The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server id: CVE-2024-10708 info: name: System Dashboard 2.8.15 - Admin+ Path...

Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read

Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process. id: CVE-2026-9133...

Planyo Online Reservation System <= 3.0 - Arbitrary File Read

The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The sendhttppost function validates the host of the supplied URL against an allowlist that includes localhost, but neve...

Nezha Dashboard < 2.0.13 - Path Traversal

Nezha Monitoring 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs. id: CVE-2026-53519 info: name: Nezha Dashboard 2.0.13 - Path Traversal author: Aryu-RU,str4k3r severity...

SiYuan - SQL Execution

SiYuan = v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleRead...