CVE-2017-1000028

CVE-2017-1000028 GlassFish4.1.14.1.1 미포함에 대한 POC&EXP. 매개변수: -u: 단일 URL /etc/passwd 출력 없음 -ut: 단일 URL /etc/passwd 출력 포함 -f: url.txt에서 URL을 읽어 취약한지 확인 -c: 반드시 "-u" 매개변수와 함께 사용. 예: python3 CVE-2017-1000028.py -u http://xxx.xxx.xxx.xxx:4848 -c /etc/hello.txt Python3에서 실행. 코딩 실력이 너무 안 좋아서... 이걸 쓸 때 욕하...

CVE-2022-44900-demo-lab

Laboratoire de démonstration CVE-2022-44900 Application web de démonstration vulnérable à CVE-2022-44900. CVE-2022-44900 est une vulnérabilité de traversée de répertoire dans la fonction SevenZipFile.extractall de la bibliothèque Python py7zr version 0.20.0 et antérieures, qui permet aux attaquan...

pipe-primitive

pipe-primitive Une primitive d'exploitation dans le noyau Linux inspirée par DirtyPipe CVE-2022-0847. Il y a quelques jours, comme beaucoup de mes aînés en sécurité, j'ai étudié et reproduit la vulnérabilité DirtyPipe CVE-2022-0847, et j'ai profondément ressenti à quel point cette faille est...

CVE-2026-49049

CVE-2026-49049 Ce dépôt contient un scanner en Python et une preuve de concept pour une vulnérabilité dans le composant Joomla Helix3. Le bug est un problème d'écriture arbitraire de fichier qui peut mener à une exécution de code à distance RCE lorsqu'un attaquant est capable d'écrire une charge...

CVE-2024-25641-Exploit-for-Cacti-1.2.26

CVE-2024-25641 Exploit pour Cacti 1.2.26 Exploitation de CVE-2024-25641 sur Cacti 1.2.26. Lorsqu'un utilisateur est authentifié, une vulnérabilité d'écriture de fichier arbitraire permet l'exécution de code à distance RCE. Aperçu Ce script automatise le processus d'exploitation de CVE-2024-25641...

CVE-2018-14847-EXPLOIT

CVE-2018-14847 - Lecture de fichier MikroTik WinBox 💥 MikroTik RouterOS jusqu'à la version 6.42 est affecté par une vulnérabilité de traversée de répertoire dans l'interface WinBox, permettant à des attaquants distants non authentifiés de lire des fichiers arbitraires et à des attaquants distants...

CVE-2026-Pending-Flask-Uploads-Path-Traversal-PoC

CVE-2026-XXXXX 대기 중: Flask-Uploads의 경로 순회 취약점 정보 제품 : Flask-Uploads 버전 : 0.2.1 및 이전 버전 가능 취약점 유형 : 경로 순회 디렉토리 순회 CWE-ID : CWE-22 심각도 : 높음 CVSS 7.5 영향 : 임의 파일 쓰기, 원격 코드 실행 RCE 설명 Flask-Uploads 0.2.1 버전에는 치명적인 경로 순회 취약점이 존재합니다. 이 라이브러리는 업로드된 파일의 파일명을 파일시스템에 저장하기 전에 제대로 검증새니타이즈하지 못합니다. 구체적으로,...

EUVD-2026-76787

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

EUVD-2026-76748

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

CVE-2026-90445 is a path traversal vulnerability in an interface that accepts file uploads from authenticated users . The root cause is that uploaded archives are extracted without validating that file paths remain within the intended destination directory, allowing an attacker to write files to ...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-87984

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-89009 WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

EUVD-2026-76129

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...

CVE-2026-89009

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 are affected by an unauthenticated arbitrary file write vulnerability in the sync_server daemon listening on TCP port 13136 . The daemon runs as root without authentication and accepts a 100-byte filename field in its pro...

EUVD-2026-76119

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-87984

Mistral Vibe , introduced in version 1.3.4 , contains an arbitrary file write vulnerability. The root cause is that shell redirection destinations are omitted from permission checks , allowing otherwise allowlisted commands to create or overwrite files at arbitrary paths accessible to the Vibe pr...