WebIQ 2.15.9 - Directory Traversal

The Windows version of WebIQ 2.15.9 is affected by a directory traversal vulnerability that allows remote attackers to read any file on the system. id: CVE-2024-8752 info: name: WebIQ 2.15.9 - Directory Traversal author: s4e-io severity: high description: | The Windows version of WebIQ 2.15.9 is...

Mysql-Readfile

Introducción Este proyecto utiliza principalmente load data local infile para obtener cualquier archivo del host del atacante plataforma Windows, y los archivos a los que se desea acceder pueden enumerarse en file.txt. Esto será muy útil cuando podamos controlar la configuración de conexión de...

CVE-2026-2636_PoC

CVE-2026-2636: Estado Irrecuperable en CLFS.sys que Provoca BSoD Descripción General CVE-2026-2636 es una vulnerabilidad en el controlador del Sistema de Archivos de Registro Común CLFS de Windows CLFS.sys. Un usuario sin privilegios puede provocar un estado irrecuperable del sistema llamando a l...

CVE-2026-95679 MISP Unauthenticated Blind SSRF via XML Body Processing

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build library contains a logic error in its readFile guard condition readFile && http || https, where PHP operator precedence causes the https branch to bypass the readFile check...

EUVD-2026-83801

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2026-94094

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2026-94094 OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

PT-2026-96013

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.9.6 Description A flaw in the Canvas Host Route component allows a remote attacker to cause a denial of service. The issue exists in the createCanvasHostHandler function within the...

Infracost: Arbitrary file read via config-template readFile symlink traversal

Impact Path traversal via link following in the Infracost config-template parser. The readFile, pathExists, isDir, and matchPaths template functions confined repo-supplied paths with a lexical filepath.Rel check plus a leaf-only os.Lstat: readFile "evil/file" With an intermediate directory symlin...

GHSA-MMG6-4QMV-6PC8 Infracost: Arbitrary file read via config-template readFile symlink traversal

Impact Path traversal via link following in the Infracost config-template parser. The readFile, pathExists, isDir, and matchPaths template functions confined repo-supplied paths with a lexical filepath.Rel check plus a leaf-only os.Lstat: readFile "evil/file" With an intermediate directory symlin...

CVE-2026-71493: Improper Limitation of a Pathname to a Restricted Directory

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...

CVE-2026-19324

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

CVE-2026-19324 HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

CVE-2026-19324 HelloGGX shadcn-vue-mcp callback-server.ts fs.promises.readFile path traversal

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

EUVD-2026-54851

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

GO-2026-5309 Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo

Hugo: Symlink confinement bypass in os.ReadFile in github.com/gohugoio/hugo...

CVE-2026-7132

A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and cou...

GHSA-W4QQ-74H6-58WQ AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`

Summary The endpoint requires no authentication. An unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails,...

CVE-2026-7132

A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and cou...

EUVD-2026-25860

A vulnerability was found in code-projects Online Lot Reservation System up to 1.0. This affects the function readfile of the file /download.php. The manipulation of the argument File results in path traversal. It is possible to launch the attack remotely. The exploit has been made public and cou...