cve-reproduction-lab

Лаборатория воспроизведения CVE Обзор Этот проект представляет собой исследовательскую лабораторию кибербезопасности, созданную для демонстрации реального воздействия уязвимостей программного обеспечения посредством контролируемой эксплуатации и имитации защитного исправления. Лаборатория...

cve-2021-41773

Rapport CVE-2021-41773 – Path Traversal Apache Résumé Vulnérabilité découverte dans Apache HTTP Server 2.4.49, permettant, selon la configuration du serveur web, d'exposer des fichiers sensibles du système via une attaque de Path Traversal. Path Traversal : un attaquant peut accéder à des fichier...

CVE-2017-1000117

Dépôt PoC pour CVE-2017-1000117 sur VulApps Fork de joernchen/CVE-2017-1000117 git clone --recursive https://github.com/VulApps/CVE-2017-1000117.git écrira la sortie de id dans un fichier vul dans /var/www/html. Voir plus sur VulApps...

CVE-2022-22965-PoC_Payara

CVE-2022-22965 PoC - Téléchargement arbitraire de fichiers Payara Exemple minimal de reproduction de la vulnérabilité Spring CVE-2022-22965 dans Payara/Glassfish. Payload alternatif pour Payara/Glassfish permettant à un utilisateur malveillant de définir une racine web arbitraire, conduisant à un...

CVE-2019-12185

CVE-2019-12185 eLabFTW 1.8.5 подвержен уязвимости произвольной загрузки файлов через компонент /app/controllers/EntityController.php. Это может привести к удалённому выполнению команд. Злоумышленник может использовать учётную запись пользователя, чтобы полностью скомпрометировать систему с помощь...

CVE-2026-76597

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939 WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

EUVD-2026-57264

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939

CVE-2026-65939 affects WhatsUp Gold releases prior to 2026.0.2. The issue allows a privileged attacker to create a LogToFile action that specifies an arbitrary file extension within the IIS web root, enabling potential unauthorized file writes. CVSS:3.1 base score 6.8 (MEDIUM), with an adjacent a...

PT-2026-71120

Name of the Vulnerable Software and Affected Versions WhatsUp Gold versions prior to 2026.0.2 Description A privileged attacker can create a LogToFile action that allows the specification of an arbitrary file extension within the IIS web root. IIS Internet Information Services is a flexible,...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55223

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55230

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

CVE-2026-46458

CVE-2026-46458 affects ICU Scandinavia Boomerang. An information-disclosure flaw allows an unauthenticated attacker to retrieve plaintext credentials by requesting specific XML files from the webroot over static HTTP. The root cause is exposure of sensitive credential files via static HTTP paths....

EUVD-2026-44621

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

CVE-2026-61873

Grav before 9.1.8 is affected by an arbitrary file write in the Form plugin via the process.save.filename parameter. The parameter is path-traversal validated before Twig processing but not re-validated after rendering, enabling an attacker to submit form data that writes arbitrary files (includi...