Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Contribuyentes 이희수@lheeeesoo Apache HTTP Server 2.4.49 contiene una vulnerabilidad en el proceso de normalización de rutas URL, ya que no bloquea adecuadamente las rutas parentales codificadas. Un atacante puede utilizar valores como .%2e para sali...

CVE-2018-11776

Vulnerable docker container for CVE-2018-11776 root@kitploit: docker pull bhdresh/cve-2018-11776:1.0 docker run -dit -p :8080:8080 bhdresh/cve-2018-11776:1.0 PoC PoC - 1 root@kitploit: Request : http://:8080/struts2-showcase-2.3.14/$333+333/help.action Result :...

CVE-2018-11776-Python-PoC

CVE-2018-11776-Python-PoC hook-s3c github.com/hook-s3c, @hooks3c en twitter Prueba y PoC en Python funcional para CVE-2018-11776, apareció originalmente en; https://github.com/hook-s3c/CVE-2018-11776-Python-PoC ¿Qué está pasando? Man Yue Mo de Semmle ha revelado una vulnerabilidad de ejecución...

ApacheStruts-CVE-2018-11776

Apache Struts CVE-2018-11776 Python PoC Esto está basado en https://github.com/hook-s3c/CVE-2018-11776-Python-PoC. La construcción del contenedor y las instrucciones no funcionaron como se describe en el README, por lo que se creó este fork. El exploit de PoC utilizado es de Rapid7...

Ally – Web Accessibility & Usability <= 4.0.3 - SQL Injection

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the getglobalremediations method, where it is directly concatenated...

shiro-cve-2020-17523

Análisis de dos métodos para evadir la autenticación en Apache Shiro CVE-2020-17523 0x01 Descripción de la vulnerabilidad Apache Shiro es un framework de seguridad Java potente y fácil de usar que realiza autenticación, autorización, gestión de contraseñas y sesiones. Con la API fácil de entender...

EUVD-2026-76831

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-85198

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO WordPress plugin is vulnerable to SQL injection via URL path in versions up to and including 4.2.1 , caused by insufficient escaping and lack of prepared statements on a user-supplied parameter. Despite the title referencing...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

CVE-2026-18562

HUSKY – Products Filter Professional for WooCommerce (WordPress plugin) versions up to and including 1.4.3 are affected by a Reflected Cross-Site Scripting vulnerability. The root cause is insufficient output escaping in the wp_load_js() function of the url_request extension: filter values read f...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Unauthenticated SQL Injection via URL Path Description The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficien...

CVE-2025-61456

🛡️ CVE Disclosure: CVE-2025-61456 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61456 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the index.php endpoint...

CVE-2021-43798-EXPLOIT

CVE-2021-43798 - Recorrido de Directorios en Grafana 🔍 Grafana es una plataforma de código abierto para monitoreo y observabilidad. Las versiones 8.0.0-beta1 hasta 8.3.0 excepto las versiones parcheadas son vulnerables a un ataque de recorrido de directorios, lo que permite el acceso no autorizad...

CVE-2021-43798

CVE-2021-43798 1. Summary Grafana is an open-source platform that supports data monitoring and management. In the versions listed below, a Path Traversal vulnerability exists that allows manipulation of file paths using special characters such as ../. 8.0.0 and above, below 8.0.7 8.1.0 and above,...

CVE-2025-60876

CVE-2025-60876: corrección de inyección en request-target de busybox wget Una corrección que preserva el comportamiento para CVE-2025-60876, una vulnerabilidad de inyección de cabeceras HTTP en BusyBox wget, junto con la prueba de concepto que la demuestra y los artefactos para enviar la correcci...

CVE-2026-29519-Lucee-Reflected-XSS

CVE-2026-29519-Lucee-Reflected-XSS Proof of Concept for Reflected XSS in Lucee CFML CVE-2026-29519 Framework 0-Day: Reflected XSS in Lucee CFML URL Parsing Affects Enterprise Deployments Versions 5.3.1.95 to 7.x Discoverer: Fouad Milat lavado Date Discovered: December 6, 2025 CVE: CVE-2026-29519...

mkpath

mkpath Make URL path combinations using a wordlist Read a wordlist file and generate path combinations for given domain or list of domains. Input from wordlist file is lowercased and unique words are processed. Additionally, wordlist can be filtered using regex. When you use mkpath's -l parameter...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

CVE-2026-82875 ToolJet before v3.16.208 Authorization Bypass via organizationId

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in security patch ina-release-callhomeimage-1.0.2.3. Vulnerability Details CVEID:CVE-2026-8384 DESCRIPTION: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:...