Nextjs <2.4.1 - Local File Inclusion

ZEIT Next.js before 2.4.1 is susceptible to local file inclusion via the /next and /static request namespace, allowing attackers to obtain sensitive information. id: CVE-2017-16877 info: name: Nextjs 2.4.1 - Local File Inclusion author: pikpikcu severity: high description: ZEIT Next.js before 2.4...

adminer_CVE-2021-43008

CVE-2021-43008 — Vulnérabilité Adminer Lecture arbitraire de fichiers via un serveur MySQL malveillant 1. Qu’est-ce qu’Adminer ? Adminer est un outil web PHP permettant d’administrer facilement des bases de données MySQL, PostgreSQL, SQLite ou SQL Server. Il est couramment déployé comme...

CVE-2024-7928

CVE-2024-7928: FastAdmin V1.3.4.20220530 Vulnérabilité de lecture arbitraire de fichiers Outil CVEHunter pour la détection et l'exploitation de vulnérabilités afin de récupérer les détails de la base de données pour les instances FastAdmin pour CVE-2024-7928 avec précision et concurrence asynchro...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update уязвимость несанкционированного доступа Broken Access Control LiteLLM /config/update не проверяет права роли вызывающего. Любой аутентифицированный пользователь с действующим API-ключом без прав администратора может изменять конфигурацию прокси,...

CVE-2024-24919

Introduction Script Python POC simple qui vérifie et exploite la vulnérabilité CVE-2024-24919 de Check Point Wrong Check Point ; vulnérable à la lecture arbitraire de fichiers. Prérequis Python 3 Pip Bibliothèque/Module requis Installation via PIP requests urllib3 tqdm Comment exécuter PS C:...

CVE-2021-3019

CVE-2021-3019 CVE-2021-3019 Lanproxy - Vulnérabilité de traversée de répertoire et lecture arbitraire de fichiers Utilisation Téléchargement git clone https://github.com/FanqXu/CVE-2021-3019.git cd CVE-2021-3019 Aide Exécutez sans paramètre pour afficher l'aide URL unique Testez une seule URL pou...

Pulse Connect Secure SSL VPN Arbitrary File Read

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. id: CVE-2019-11510 info: name: Pulse...

SUSE CVE-2026-53474

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL...

Open WebUI Allows Arbitrary File Reading and Deletion

An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...

LoLLMS Path Traversal vulnerability

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitizepathfromendpoint and sanitizepath functions in lollmscore\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises...

CVE-2016-20077 WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php

WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoin...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the rvtools upload process. An attacker can execute malicious SQL embedded within a spreadsheet cell by uploading a specially crafted .xlsx file, leading to arbitrary file reading on the system and potential exposure o...

PT-2026-48522

Name of the Vulnerable Software and Affected Versions Evilginx community edition affected versions not specified Description A path traversal issue exists in the redirector templates of the community edition, which allows for arbitrary file reading. This occurs in lures configured with redirector...

CVE-2026-53474: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL...

CVE-2025-0898

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

CVE-2025-0898

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

EUVD-2025-209964

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

CVE-2025-0898

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

CVE-2025-0898: External Control of File Name or Path

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...

PT-2026-43632

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on...