Nextjs <2.4.1 - Local File Inclusion

ZEIT Next.js before 2.4.1 is susceptible to local file inclusion via the /next and /static request namespace, allowing attackers to obtain sensitive information. id: CVE-2017-16877 info: name: Nextjs 2.4.1 - Local File Inclusion author: pikpikcu severity: high description: ZEIT Next.js before 2.4...

adminer_CVE-2021-43008

CVE-2021-43008 — Adminer भेद्यता दुर्भावनापूर्ण MySQL सर्वर के माध्यम से मनमानी फ़ाइल पढ़ना 1. Adminer क्या है? Adminer एक वेब टूल PHP है जो MySQL, PostgreSQL, SQLite या SQL Server डेटाबेस को आसानी से प्रबंधित करने की अनुमति देता है। इसे आमतौर पर phpMyAdmin के हल्के विकल्प के रूप में तैनात किया...

CVE-2024-7928

CVE-2024-7928: FastAdmin V1.3.4.20220530 मनमाना फ़ाइल पठन भेद्यता CVEHunter टूल अन्य POC की तुलना में सटीकता और अतुल्यकालिक समवर्तीता के साथ CVE-2024-7928 के लिए FastAdmin इंस्टेंसेस का पता लगाने और DB विवरण प्राप्त करने हेतु शोषण करने वाला उपकरण है। स्थापना root@kitploit: git clone...

CVE-2024-24919

مقدمة نص بايثون بسيط يتحقق ويستغل ثغرة CVE-2024-24919 في Check Point Wrong Check Point؛ عرضة لقراءة الملفات التعسفية. المتطلبات Python 3 Pip المكتبات/الوحدات المطلوبة التثبيت عبر PIP requests urllib3 tqdm كيفية التشغيل root@kitploit: PS C:\ python CVE-2024-24919.py list.txt output.txt Processing:...

CVE-2021-3019

CVE-2021-3019 CVE-2021-3019 lanproxy निर्देशिका भ्रमण मनमाना फ़ाइल पढ़ने की भेद्यता उपयोग विधि डाउनलोड root@kitploit: git clone https://github.com/FanqXu/CVE-2021-3019.git cd CVE-2021-3019 सहायता बिना किसी पैरामीटर के डिफ़ॉल्ट रूप से चलाने पर सहायता संदेश दिखाई देता है एकल URL एकल URL पर भेद्यता...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update ثغرة الوصول غير المصرح به Broken Access Control LiteLLM نقطة النهاية /config/update لا تتحقق من صلاحيات دور المستدعي. يمكن لأي مستخدم مصدق يحمل مفتاح API صالح بدون الحاجة إلى صلاحيات المشرف تعديل تكوين الوكيل وتسجيل نقاط نهاية مرور ضارة لتنفيذ هجمات مثل سرق...

Open WebUI Allows Arbitrary File Reading and Deletion

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...

Pulse Connect Secure SSL VPN Arbitrary File Read

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. id: CVE-2019-11510 info: name: Pulse...

CVE-2016-20077 WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php

WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoin...

PT-2026-48522

Name of the Vulnerable Software and Affected Versions Evilginx community edition affected versions not specified Description A path traversal issue exists in the redirector templates of the community edition, which allows for arbitrary file reading. This occurs in lures configured with redirector...

CVE-2025-0898

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

CVE-2025-0898

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

EUVD-2025-209964

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

CVE-2025-0898

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

PT-2026-43632

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

WordPress plugin Xpro Elementor Addons - Pro 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

Frappe 路径遍历漏洞

Frappe is a web development framework based on Python and Mariadb, with integrated front-end pages, developed by the Indian company Frappe. Versions of Frappe prior to 15.105.0 and 16.15.0 have a path traversal vulnerability. This vulnerability arises from the possibility that path traversal may...

cPanel 输入验证错误漏洞

cPanel is a web-based automated hosting platform developed by the cPanel company in the United States. This platform is primarily used for automating the management of websites and servers. cPanel has a vulnerability related to input validation errors. This vulnerability stems from insufficient...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.10 contained security vulnerabilities. These vulnerabilities stemmed from arbitrary file reading in the QQBot media tag, allowing attackers to reference local paths on hosts...

Roxy-WI 路径遍历漏洞

Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions prior to Roxy-WI 8.2.6.4 contained a path traversal vulnerability, which stemmed from a vulnerability in the oldconfig parameter of the haproxysectionsave interface, allowing arbitrary...