CVE-2019-12185

CVE-2019-12185 eLabFTW 1.8.5 容易通过 /app/controllers/EntityController.php 组件遭受任意文件上传漏洞攻击。这可能导致远程命令执行。攻击者可以使用一个用户帐户，通过 POST 请求完全攻陷系统。这将允许 PHP 文件写入 Web 根目录，并在远程服务器上执行代码。→ https://nvd.nist.gov/vuln/detail/CVE-2019-12185 使用示例 参数 root@kitploit: $ python3 CVE-2019-12185.py --help usage: CVE-2019-12185.py...

CVE-2022-22965-PoC_Payara

CVE-2022-22965 PoC - Payara मनमाना फ़ाइल डाउनलोड CVE-2022-22965 Spring भेद्यता को Payara/Glassfish में पुन: उत्पन्न करने का न्यूनतम उदाहरण। Payara/Glassfish के लिए वैकल्पिक पेलोड जो दुर्भावनापूर्ण उपयोगकर्ता को मनमाना वेब रूट सेट करने की अनुमति देता है, जिससे मनमाना फ़ाइल डाउनलोड होता है। डॉकर...

CVE-2017-1000117

مستودع PoC لـ CVE-2017-1000117 لصالح VulApps مشتق من joernchen/CVE-2017-1000117 git clone --recursive https://github.com/VulApps/CVE-2017-1000117.git سيكتب مخرجات الأمر id إلى ملف vul في /var/www/html. انظر المزيد في VulApps...

cve-2021-41773

CVE-2021-41773 – Apache Path Traversal Bericht Zusammenfassung Schwachstelle in Apache HTTP Server 2.4.49, die je nach Webserver-Konfiguration durch einen Path-Traversal-Angriff den Zugriff auf sensible Systemdateien ermöglicht Path Traversal: Ein Angreifer kann Pfade mit ../ verwenden, um auf...

CVE-2026-76597

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...

cve-reproduction-lab

مختبر إعادة إنتاج الثغرات CVE نظرة عامة هذا المشروع هو مختبر أبحاث في الأمن السيبراني مصمم لإظهار الأثر الواقعي لثغرات البرمجيات من خلال استغلال مُتحكَّم فيه ومحاكاة للتصحيحات الدفاعية. يركز المختبر على CVE-2021-41773، وهي ثغرة حرجة من نوع اجتياز المسار Path Traversal في خادم Apache HTTP تسمح...

CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

EUVD-2026-57264

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939 WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...

CVE-2026-65939

CVE-2026-65939 affects WhatsUp Gold releases prior to 2026.0.2. The issue allows a privileged attacker to create a LogToFile action that specifies an arbitrary file extension within the IIS web root, enabling potential unauthorized file writes. CVSS:3.1 base score 6.8 (MEDIUM), with an adjacent a...

PT-2026-71120

Name of the Vulnerable Software and Affected Versions WhatsUp Gold versions prior to 2026.0.2 Description A privileged attacker can create a LogToFile action that allows the specification of an arbitrary file extension within the IIS web root. IIS Internet Information Services is a flexible,...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55223

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

EUVD-2026-55230

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

CVE-2026-46458

CVE-2026-46458 affects ICU Scandinavia Boomerang. An information-disclosure flaw allows an unauthenticated attacker to retrieve plaintext credentials by requesting specific XML files from the webroot over static HTTP. The root cause is exposure of sensitive credential files via static HTTP paths....

EUVD-2026-44621

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

CVE-2026-61873

Grav before 9.1.8 is affected by an arbitrary file write in the Form plugin via the process.save.filename parameter. The parameter is path-traversal validated before Twig processing but not re-validated after rendering, enabling an attacker to submit form data that writes arbitrary files (includi...