Karel IP Phone IP1211 Web Management Panel - Local File Inclusion

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. id: CVE-2025-34023 info: name: Karel IP Phone IP1211 Web Management Pane...

mTheme Unus < 2.3 - Directory Traversal

The mTheme-Unus theme for WordPress, prior to version 2.3, contained a directory traversal flaw that let attackers access arbitrary files. This was possible by exploiting the files parameter in css/css.php with .. sequences. id: CVE-2015-9406 info: name: mTheme Unus 2.3 - Directory Traversal...

CVE-2019-3799

CVE-2019-3799 - स्प्रिंग-क्लाउड-कॉन्फिग-सर्वर डायरेक्टरी ट्रैवर्सल स्प्रिंग क्लाउड कॉन्फिग, संस्करण 2.1.x 2.1.2 से पहले, संस्करण 2.0.x 2.0.4 से पहले, और संस्करण 1.4.x 1.4.6 से पहले, और पुराने असमर्थित संस्करण, स्प्रिंग-क्लाउड-कॉन्फिग-सर्वर मॉड्यूल के माध्यम से एप्लिकेशन को मनमाने कॉन्फ़िगरेशन...

cve-2024-38819

CVE-2024-38819 01. Aperçu de File-Traversal et WebFlux 1 Aperçu de File-Traversal et de WebFlux La vulnérabilité File-Traversal parcours de chemin, Path Traversal permet à un attaquant de contourner les autorisations du système de fichiers dans une application web et d'accéder à des fichiers...

CVE-2026-85661

excel-mcp-server 0.1.8 (by haris-musa) contains a path confinement bypass in stdio mode : when the EXCEL_FILES_PATH environment variable is unset, unchecked file paths supplied to the read and write tools allow an attacker to read and write arbitrary files accessible to the process. The vulnerabi...

PT-2026-85574

Name of the Vulnerable Software and Affected Versions TEN Framework version 0.11.71 Description The TMAN Designer component contains flaws allowing unauthenticated users to read and write arbitrary files. By sending POST and PUT requests to the '/api/designer/v1/file-content' endpoint, an attacke...

PT-2026-85554

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL FILES PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85176

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

EUVD-2026-70480

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85176

DbGate through 7.2.6 is vulnerable to arbitrary file read and write via the file:// scheme. The root cause lies in the jsldata controller , which fails to properly validate jslid parameters. An attacker can exploit the getJslFileName() function to bypass directory containment, allowing authentica...

CVE-2024-23334-PoC

CVE‑2024‑23334 اجتياز المسار - PoC لقد أنشأت هذا السكريبت لأتمتة استغلال CVE‑2024‑23334 على جهاز Hack The Box Chemistry. تؤثر هذه الثغرة على إصدارات aiohttp ≥ 1.0.5 و 3.9.2 عندما يتم تكوين التطبيق لخدمة الملفات الثابتة مع followsymlinks=True، مما يسمح باجتياز الدليل عن بعد والوصول غير المصرح به إ...

CVE-2024-9047

CVE-2024-9047 CVE-2024-9047, wfufiledownloader.php wfufiledownloader.php फ़ाइल के माध्यम से पहुँच, WordPress File Upload Solution poc, समाधान में भेद्यता उत्पन्न होती है, मनमाने ढंग से फ़ाइलों तक पहुँचकर उन्हें हेरफेर या संशोधित किया जा सकता है...

ulteriusExploit

ulteriusExploit CVE-2017-16806 के लिए Python शोषण Ulterius Server 1.9.5.0 पर डायरेक्टरी ट्रैवर्सल मनमानी फ़ाइल पहुँच शोषण Rick Osgood द्वारा CVE-2017-16806...

CVE-2022-36203

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:25+00:00| seen| https://t.me/hackingAttack/67590 2026-09-02 01:01:39+00:00| seen| https://t.me/hackingAttack/67590 2026-09-05 11:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/67590 2026-09-06 00:00:50+00:00|...

ktor-cve-2023-45612-poc

Ktor XXE भेद्यता प्रूफ-ऑफ-कॉन्सेप्ट CVE-2023-45612 सारांश प्रभाव: एक विशेष रूप से निर्मित XML DTD के माध्यम से XXE संदर्भ के साथ मनमानी फ़ाइलों तक पहुंच। मूल कारण: असुरक्षित XML दस्तावेज़ पार्सर। इस रिपॉजिटरी में एक भेद्य Ktor 2.3.4 ऐप है जिसे बाहरी एंटिटी की अनुमति देने के लिए कॉन्फ़िगर किया गया...

Codeium Windsurf Path Traversal Vulnerability (CVE-2025-62353)

The version of Windsurf installed on the remote host is affected by a path traversal vulnerability: - A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user's system. The...

CVE-2026-65400

CVE-2026-65400 لأول مرة منذ فترة، لدينا ثغرة RCE على نظام MacOS. اكتُشفت في الأصل بواسطة @osxreverser، ثم وُسّعت لاحقًا بواسطة bynar.io. انظر https://blog.calif.io/p/no-country-for-old-passwords لمزيد من المعلومات. هذا مستمد في الغالب من عمل @panchocosil حسنًا، من Claude...، الذي نشر PoC للقراءة...

CVE-2026-40541

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-40541

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

PT-2026-82877

Name of the Vulnerable Software and Affected Versions Synology Chat Server versions prior to 2.4.5-22148 Description An improper neutralization of input during web page generation, known as Cross-site Scripting XSS, occurs in the extract domain component. This allows remote authenticated users,...