CVE-2018-14847

WinboxExploit これは、クリティカルなWinBoxの脆弱性（CVE-2018-14847）の概念実証であり、プレーンテキストのパスワードの任意のファイル読み取りを可能にします。 ブログ記事 https://n0p.me/winbox-bug-dissection/ 必要条件 Python 3+ このスクリプトはPython 2.x以下では動作しません。 使用方法 このスクリプトは、コマンドラインでシンプルな引数を使って簡単に使用できます。 WinBox TCP/IP 脆弱性を悪用してパスワードを読み取ります。 root@kitploit: python3...

CVE-2023-40028

CVE-2023-4002 Ghost-任意文件读取 ：目标 Ghost CMS 的用户名/电子邮件。 --password ：目标 Ghost CMS 的密码。 --url ：目标 Ghost CMS 的 URL（例如 http://website.com）。 1. 登录：脚本通过 Ghost CMS 管理员 API 进行身份验证，并获取会话 Cookie。 2. 交互式 Shell：登录后，脚本会提示输入要从服务器读取的文件路径。 Shell 示例： 参考 CVE-2023-40028 1。 CVE-2023-40028 2。 免责声明 此脚本仅供教育用途。...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. 漏洞概述 CVE-2025-30208, CVE-2025-31125和CVE-2025-31486是Vite 开发服务器中的一个任意文件读取漏洞。该漏洞允许攻击者通过特定的 URL 参数绕过访问控制，通过fs模块读取服务器上的敏感文件。上述三个漏洞可以算作是一个系列的漏洞，因为造成漏洞的原因非常相似。 CVE-2025-30208影响版本如下所示 root@kitploit: =6.2.0, =6.1.0, =6.0.0, =5.0.0, =6.2.0, =6.1.0, =6.0.0...

CVE-2025-30208

🔥 CVE-2025-30208 Vite 任意文件读取漏洞扫描器 CVE-2025-30208 高级漏洞扫描器，具备企业级特性 用于检测 Vite 任意文件读取漏洞的专业渗透测试工具 🚀 快速开始 • 📋 功能特性 • 🔧 使用方法 • 📊 示例 • 🛡️ 安全 📖 概述 这是一个综合性漏洞扫描器，旨在检测和利用 Vite 开发服务器中的 CVE-2025-30208 漏洞。该漏洞允许攻击者通过 Vite 的文件系统端点实现任意文件读取，从而可能暴露敏感配置文件、源代码和系统信息。 🎯 此工具的功能 检测 网络中存在漏洞的 Vite 实例 安全地利用 任意文件读取漏洞 发现...

CVE-2021-43798

CVE-2021-43798 1. 概述 Grafana 是一个支持数据监控和管理功能的开源平台，在以下版本中存在路径遍历漏洞，可通过 ../ 等特殊字符操纵文件路径。 8.0.0 及以上，但低于 8.0.7 8.1.0 及以上，但低于 8.1.8 8.2.0 及以上，但低于 8.2.7 8.3.0 漏洞路径为 /public/plugins//，其中 是已安装插件的 ID。可通过以下资料确认脆弱路径。 https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p 2. 配置和运行漏洞环境 2.1...

CVE-2025-46822

CVE-2025-46822 Lectura arbitraria de archivos sin autenticación mediante ruta absoluta Descripción: Mientras que el método Path.resolve se usa para proteger contra el path traversal, he descubierto que el uso de una ruta absoluta permite leer archivos internos con éxito; el endpoint tampoco está...

CVE-2021-43798

CVE-2021-43798 - Grafana 任意文件读取 用于 CVE-2021-43798 授权测试的 Python 工具包，该漏洞为 Grafana 路径遍历漏洞，可通过插件资产路径实现未经认证的任意文件读取。 本仓库包含： grafanapoc.py：交互式任意文件读取 PoC，可将下载的文件保存到本地。 grafanapassdecryptor.py：辅助工具，用于在拥有 grafana.ini 和/或 secretkey 时解密 Grafana 加密的数据源密钥，并从 grafana.db 导出 Grafana 用户密码哈希。 警告...

CVE-2017-5223

CVE-2017-5223 IsSMTP; $mail-Host = "smtp.evil.com"; $mail-Port = 25; $mail-SMTPAuth = true; $mail-CharSet = "UTF-8"; $mail-Encoding = "base64"; $mail-Username = "[email protected]"; $mail-Password = "tes1234t"; $mail-Subject = "hello"; $mail-From = "[email protected]"; $mail-FromName =...

Lightdash version <= 0.510.3 Arbitrary File Read

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension .csv or .png is used. id: CVE-2023-35844 info: name: Lightdash version = 0.510.3 Arbitrary File Read author: dwisiswant0...

TOTVS Fluig <= 1.7.0 - Arbitrary File Read

TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation of the 'file' parameter, letting attackers access arbitrary files, exploit requires attacker to control the 'file' parameter. id: CVE-2020-29134 info: name: TOTVS Fluig = 1.7.0 - Arbitrary File Read author: ls4ss...

Planyo Online Reservation System <= 3.0 - Arbitrary File Read

The Planyo Online Reservation System plugin for WordPress through 3.0 ships ulap.php, an AJAX proxy that is directly reachable without WordPress bootstrapping or authentication. The sendhttppost function validates the host of the supplied URL against an allowlist that includes localhost, but neve...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

CrateDB Database - Arbitrary File Read

CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY...

Mitel MiCollab - Arbitary File Read

The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attack...

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read

Microweber CMS = 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files. id: CVE-2026-65694 info: name: Microweber CMS = 2.0.20 - Unauthenticated Arbitrary File Rea...

Audiobookshelf - Authentication Bypass

Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences. id: CVE-2026-71209 info: name:...

Amazon rabbitmq-aws 0.1.0 through 0.2.0 - Arbitrary File Read

Amazon rabbitmq-aws versions 0.1.0 through 0.2.0 contain active debug code in the ARN resolver. An authenticated RabbitMQ user with management API access can submit an arn:aws-debug:file ARN to the validation endpoint and read arbitrary files accessible to the RabbitMQ process. id: CVE-2026-9133...

Nezha Dashboard < 2.0.13 - Path Traversal

Nezha Monitoring 2.0.13 contains a path traversal caused by improper prefix checking in the dashboard's NoRoute handler, letting unauthenticated attackers read arbitrary files via crafted URLs. id: CVE-2026-53519 info: name: Nezha Dashboard 2.0.13 - Path Traversal author: Aryu-RU,str4k3r severity...

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...