137 matches found
Remot3d
Remot3d - Una Forma Fácil de Explotar Se actualizará pronto Es fácil crear una puerta trasera al instante, la puerta trasera se puede usar en un proceso remoto a través de una terminal de Linux en el servidor que ejecuta el programa de lenguaje PHP. Hecho para evadir el sistema que está...
CVE-2020-12112
CVE-2020-12112 🚨 BigBlueButton バージョン 2.2.4 未満には、機密ファイルへのアクセスを許可する LFI 脆弱性があります。 ストーリー 📜 BigBlueButton インスタンスを使った遠隔授業中、クラスの生徒が先生のスライドプレゼンテーションのリンクを共有したところ、URL にファイル名が含まれていることに気づきました。 root@kitploit: Student: "No need to write notes, I've got the slide." Me: Well, I've got a security report to make....
CVE-2023-37739---Path-Traversal-in-i-doit-Pro-25-and-below
CVE-2023-37739 - i-doit Pro 25 及以下版本中的路径遍历漏洞 i-doit Pro 25 及以下版本存在路径遍历漏洞。这些漏洞可能允许远程认证攻击者（低权限或高权限）导航到用户不应访问的位置。该漏洞可用于读取和/或访问敏感文件。 产品描述：i-doit 是由 synetics GmbH 开发的基于 Web 的 IT 文档和 CMDB（配置管理数据库），i-doit Pro 是该软件的商业版本，需要付费许可证。它附带附加功能、专业支持以及定期更新和增强功能。用户需要购买许可证才能使用 i-doit Pro，其价格因用户数量和所需功能而异。 漏洞描述：我们发现该...
CVE-2022-46604-Responsive-File-Manager
CVE 2022 46604 – Responsive File Manager ⚠️ 免責事項 このリポジトリは教育および研究目的のみに提供されています。 ここで提供される情報とコードは、プライベートラボマシンなどの管理された環境でのみ使用できます。 所有していない、または明示的なテスト許可を得ていないシステムに対するこのコードの不正使用は、違法かつ非倫理的です。 著者は、この資料を使用した結果生じる誤用や損害について一切責任を負いません。 🔍 脆弱性について CVE 2022 46604 は、Webアプリケーションやコンテンツ管理システムに統合されることの多いファイル管理プラグイン...
Vitejs-exploit
Vite 利用工具 CVE-2025-31125 描述：利用Vite开发服务器@fs端点的路径遍历漏洞CVE-2025-31125，通过精心构造的URL访问敏感文件，如/etc/passwd和/etc/hosts。 由Muhammad Waseem创建。 用法： python viteexploit.py -u http://target.com python viteexploit.py -f urls.txt -o output.txt 依赖： Python 3.x pip install requests colorama 免责声明：...
CVE-2022-44311
CVE-2022-44311 描述 发现 html2xhtml v1.3 在函数 static void elmclosetreenodet nodo at procesador.c 中存在越界读取。该漏洞允许攻击者通过精心构造的 html 文件访问敏感文件或导致拒绝服务 DoS。 复现步骤 要复现该漏洞，下载易受攻击版本的 html2xhtml v1.3 并编译项目： root@kitploit: wget http://www.it.uc3m.es/jaf/html2xhtml/downloads/html2xhtml-1.3.tar.gz tar -xzvf...
CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...
CVE-2026-76198
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...
Linux Distros Unpatched Vulnerability : CVE-2026-55554
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after...
CVE-2016-20081
HB Audio Gallery Lite 1.0.0 (WordPress) has a path traversal in audio-download.php via the file_path parameter that allows unauthenticated access to arbitrary files outside the gallery directory (e.g., wp-config.php). Root cause: inadequate validation of the file_path input. The connected documen...
CVE-2017-20250
CVE-2017-20250 affects WordPress plugin Mac Photo Gallery 3.0 through a path traversal vulnerability in macdownload.php that allows unauthenticated attackers to download arbitrary files (e.g., wp-load.php) by manipulating the albid parameter. Reported impact includes potential high confidentialit...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal due to insufficient path sanitization in the osfs.ChrootOS component. An attacker can gain unauthorized access to unintended filesystem locations by supplying crafted paths containing directory traversal sequences...
CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...
Incorrect Behavior Order: Validate Before Canonicalize
Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize through the server.fs.deny component. An attacker can access sensitive files by appending specific query parameters such as ?raw,...
CVE-2026-0847
A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling...
CVE-2021-47899 YetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability
YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote file upload feature. Attackers can exploit the url parameter in the urluploadhandler endpoint to access sensitive files like /etc/passwd by...
GHSA-R2H2-G46H-8MX8 pretix has Broken Access Control Allowing Cross-User File Access via UUID
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only...
EUVD-2020-26954
Malware in sbrugna...