697 matches found
ChopChop
ChopChop ChopChop एक कमांड-लाइन टूल है जो वेब एप्लिकेशनों पर डायनामिक एप्लिकेशन सुरक्षा परीक्षण DAST के लिए है, जिसे मूल रूप से मिशेलिन CERT द्वारा लिखा गया था। इसका लक्ष्य कई एंडपॉइंट्स को स्कैन करना और वेबरूट के माध्यम से सेवाओं/फ़ाइलों/फ़ोल्डरों के एक्सपोज़र की पहचान करना है। जाँच/सिग्नेचर एक...
zimbramail-CVE-2025-68645-poc
zimbramail-CVE-2025-68645-poc إثبات مفهوم PoC يستغل ثغرة تضمين الملفات المحلية Local File Inclusion - LFI الموجودة في واجهة Webmail Classic UI الخاصة بـ Zimbra Collaboration ZCS 10.0 و10.1 بسبب المعالجة غير السليمة لمعاملات الطلب المقدمة من المستخدم في RestFilter servlet. الثغرة توجد الثغرة بسبب...
CVE-2026-66493
Path Traversal في عمليات الملفات حذف / نسخ / نقل PhocaCommander ≤ 6.1.3 — مدير مصادق يعبث بالملفات خارج جذر الويب ملخص يقوم معالج إجراءات الملفات في PhocaCommander ببناء مسارات المصدر والوجهة من معاملات مُرمّزة بـ base64 يتحكم بها المهاجم pathfrom, pathwhere دون أي تحقق من احتواء المسار. يمكن لمد...
EUVD-2026-86161
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...
Zimbra Collaboration - Local File Inclusion
Zimbra Collaboration ZCS 10.0 and 10.1 contain a local file inclusion caused by improper handling of user-supplied parameters in the RestFilter servlet, letting unauthenticated remote attackers include arbitrary files from WebRoot, exploit requires crafted requests to /h/rest endpoint. id:...
CVE-2026-61639 Wallos: Zip Slip path traversal in database restore writes files to webroot
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to...
CVE-2026-76597 Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...
CVE-2026-76597
Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.2 contain an unauthenticated arbitrary file upload vulnerability in the list email plugin controller , which allows an attacker to upload non-executable files to the web root without authentication. The CVSS 4.0 score is 8.7 (HIGH)...
EUVD-2026-64326
Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot...
PT-2026-79573
Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description The list email plugin controller allows an unauthenticated user to upload non-executable files directly to the web root. Recommendations Update to version 4.7.2 or later...
CVE-2026-18412 The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...
CVE-2026-18412
The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability during the installation of .ocmod.zip files. The installer extracts these files but fails to validate that the extracted paths remain within the intended directory. An attacker can craft a malicious extension u...
CVE-2026-18412: Undefined Security Weakness
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...
CVE-2026-66914
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
CVE-2026-66914
CVE-2026-66914 concerns the Joomla extension SEBLOD. Affected versions are SEBLOD < 3.30.0, < 4.7.0, and
CVE-2026-66914 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
EUVD-2026-54480
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
CVE-2026-66914: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...
GHSA-WG2Q-39H6-66X9 goshs has a Path Traversal issue
Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding Medium: upload filename escapes the served tree residual of CVE-2026-35393 The multipart filename fix updown.go lines 135-136 splits on the path...
goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)
GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes PUT/POST upload/?mkdir/?delete and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route...