CVE-2021-32159

..| CSRFtoCommandInjection1 |.. 説明 : Webmin の「アップロードとダウンロード」機能を介して、クロスサイトリクエストフォージェリ CSRF 攻撃を悪用し、コマンドインジェクションを引き起こす テスト済みバージョン : Webmin 1.973 GitHub の最新版 2021/03/07 攻撃タイプ : リモート 影響 : コマンド実行 エクスプロイトのコード PoC : 製品のベンダー : https://www.webmin.com 追加情報 : "Webmin は、Unix 系サーバー向けの Web ベースのシステム管理ツールで、世界中で 1...

CVE-2021-32158

..| XSStoCommandInjection1 |.. 설명 : Webmin의 업로드 및 다운로드 기능을 통해 반사형 교차 사이트 스크립팅XSS 공격을 악용하여 명령 주입을 수행합니다. 테스트된 버전 : Webmin 1.973 GitHub's latest version 07/03/2021 공격 유형 : 원격 영향 : 명령 실행 eXploit's C0de POC : 제품 공급업체 : https://www.webmin.com 추가 정보 : "Webmin is a web-based system administration tool f...

pyradm

🔮 pyradm Remote administration crossplatfrom tool via telegram Coded with ❤️ python3 + aiogram3 https://t.me/whlab Screenshots Disclaimer All information contained in this repository is provided for educational and research purposes only The author is not responsible for any illegal use of this...

CVE-2026-27892

FacturaScripts Library module stores and serves uploaded images without stripping EXIF/IPTC/XMP metadata, allowing any authenticated user who downloads an image to extract GPS coordinates, device information, timestamps, and other PII embedded in metadata. This is a design-level omission affectin...

CVE-2026-5773

CVE-2026-5773 affects libcurl and involves a logical error in the SMB connection reuse pool. The code could reuse an existing SMB connection to the same server but with a different share, potentially causing the wrong file to be downloaded or a file to be uploaded to the wrong location, while cre...

The vulnerability of Novakon P Series human-machine interface programming software lies in the lack of authentication procedures, allowing attackers to gain access to the upload and download of arbitrary files.

The vulnerability of Novakon P Series human-machine interface programming software is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain access to the ability to download and save any arbitrary files...

CVE-2026-0522

A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled pat...

CVE-2026-0522

A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled pat...

CVE-2026-0522 Local File Inclusion in the File Upload/Download Process

A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled pat...

CVE-2026-0522

The CVE-2026-0522 issue affects VertiGIS FM (v10.5.00119) in the upload/download flow. A Local File Inclusion vulnerability allows an authenticated attacker to read arbitrary server files by manipulating the file path during upload; the downloaded file from the attacker-controlled path is then re...

PT-2026-29515

A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled pat...

CVE-2023-43696

Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP server...

Exploit for CVE-2025-55182

CVE-2025-55182-shellinteractive Base used from: https://gith...

Files 授权问题漏洞

Files is a single-file PHP application by the individual developer Karl Ward. It can be dragged and dropped into any directory, allowing browsing of the files and directories within. An authorization issue vulnerability exists in Files versions prior to 0.16.11 and 0.17.2, which stems from...

EUVD-2024-49190

Malicious code in bioql PyPI...

EUVD-2024-25912

Malicious code in bioql PyPI...

CVE-2025-9965

Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

CVE-2025-9965 UDP Service Weak Authentication

Improper authentication vulnerability in Novakon P series allows unauthenticated attackers to upload and download any application from/to the device.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

CVE-2024-13799: Improper Neutralization of Input During Web Page Generation

The User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘new-fldr-name’ parameter in all versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes i...

PT-2025-7392

Name of the Vulnerable Software and Affected Versions User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress versions up to, and including, 2.1.3 Description The issue is related to Stored Cross-Site Scripting via the new-fldr-name parameter due to...