CVE-2024-46635

CVE-2024-46635 Background The GongZhiDao System is a platform developed by GongZhiDao. It provides enterprise solutions including user management, data analysis, and operational functionalities. However, a security vulnerability was discovered in one of the API endpoints that could potentially le...

PoC-CVE-2021-41773

Explotación de Path Traversal en Apache HTTP Server CVE-2021-41773 Un exploit en Python para CVE-2021-41773, una vulnerabilidad de path traversal en Apache HTTP Server 2.4.49 que permite leer archivos arbitrarios del servidor. Detalles de la vulnerabilidad CVE-2021-41773 es una vulnerabilidad de...

CVE-2021-41773

CVE-2021-41773 — PoC: Path Traversal + RCE via modcgi Solo para uso en entornos controlados y propios. No usar contra sistemas sin autorización. Descripción PoC desarrollada para demostrar y entender la vulnerabilidad CVE-2021-41773 , presente en Apache HTTP Server 2.4.49. El fallo reside en la...

CVE-2026-59816

Joplin Server (prior to 3.7.7 ) is vulnerable to a path traversal in its transcription proxy endpoints. When TRANSCRIBE_ENABLED=true, the GET and POST /api/transcribe/:id handlers pass the decoded job ID directly into backend URLs. An authenticated user can inject URL-encoded slash and parent-dir...

CVE-2026-59816 Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBEENABLED=true pass t...

CVE-2023-42793

About CVE-2023-42793 You will need to obtain the token first through using different exploit. However, the following exploit will allow you to obtain RCE into the Linux server as it encoded the payload in URL and sends it to the server. How to use root@kitploit: python3 ./main -t TEAMCITYTOKEN -u...

CVE-2023-42793

About CVE-2023-42793 You will need to obtain the token first through using different exploit. However, the following exploit will allow you to obtain RCE into the Linux server as it encoded the payload in URL and sends it to the server. How to use root@kitploit: python3 ./main -t TEAMCITYTOKEN -u...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-12071 TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters

The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 302 HTTP response. By using URL-encoded characters such as “%2e” representing a dot, an attacker can manipulate the portion of the URL following the...

IBM Langflow OSS path traversal vulnerability (CNVD-2026-32376)

IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a path traversal vulnerability. This vulnerability arises from failing to properly validate URL-encoded path traversal sequences in file names when handling MCP resources/read...

EUVD-2026-45379

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

PT-2026-60961

Name of the Vulnerable Software and Affected Versions @fastify/http-proxy versions prior to 11.6.0 Description An improper input normalization issue exists where the software fails to rewrite the request prefix when the prefix segment is URL-encoded. While the router URL-decodes paths for route...

GHSA-62GX-5Q78-WRVX obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

Summary The Local REST API's /vault/path endpoints GET/PUT/PATCH/POST/DELETE percent-decode the request path inside the handler — after Express has already routed and normalized it, then hand it to the Obsidian vault adapter with no confinement check. A literal ../ is resolved/rejected at the...

CVE-2026-42447 jadx: HTML Injection in Summary panel

jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...

CVE-2026-53539

A flaw was found in Python-Multipart, a streaming multipart parser. A remote attacker can exploit this vulnerability by submitting a specially crafted application/x-www-form-urlencoded body. This can cause the QuerystringParser to perform inefficient processing, leading to excessive CPU...

PT-2026-59658

Summary When parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the...

CVE-2026-57211 RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...

PT-2026-57296

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 Description On Windows, the RabbitMQ management plugin static file handler rabbit mgmt wm static can pass URL-encoded backslashes to the erl prim loader:read file info function...