Fonoster-LFI-PoC

CVE-2024-43035 - Fonoster LFI Prova di concetto Questo repository contiene uno script di prova di concetto PoC che dimostra una vulnerabilità di Local File Inclusion in Fonoster. Questo strumento è destinato esclusivamente a scopi educativi e di test autorizzati. Utilizzo Leggere un file locale P...

CVE-2019-6447-ES-File-Explorer

CVE-2019-6447: Servizio HTTP non autenticato di ES File Explorer Un harness di ricerca implementato indipendentemente, attento alla sicurezza, e un'analisi tecnica per CVE-2019-6447 , un servizio HTTP non autenticato esposto da versioni vulnerabili di ES File Explorer per Android. Solo ricerca...

PT-2026-81916

Name of the Vulnerable Software and Affected Versions Compliance-trestle versions prior to 3.12.4 Compliance-trestle versions 4.0.0 through 4.0.3 Description Compliance-trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. The catalog-generate, profile-generate, a...

PT-2026-81517

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender Linux client affected versions not specified Description A path traversal issue exists within the OPSWAT tarball component. This flaw allows an attacker to write arbitrary files with root privileges. Path traversal is a...

PT-2026-81154

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An arbitrary file read issue exists in the TagReference.create function. A positional reference parameter allows the bypass of the unsafe option guard, enabling attackers to provide a reference...

PT-2026-81178

Name of the Vulnerable Software and Affected Versions Mane theme for WordPress versions prior to 1.8 Description The Mane theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, which can lead to the...

PT-2026-81848

Name of the Vulnerable Software and Affected Versions dbgpt-app versions prior to 0.8.1 Description An issue exists in the skill upload endpoint within packages/dbgpt-app/src/dbgpt app/openapi/api v1/agentic data api.py where the destination path for uploaded skills is constructed using the...

PT-2026-81153

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An incomplete denylist in the unsafe git revision options guard fails to include the --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the...

UBUNTU-CVE-2026-63312

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...

UBUNTU-CVE-2026-62383

nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely. Attackers can place a symlink in the corpus root directory and read arbitrary files accessible to the process by calling channels,...

Linux Distros Unpatched Vulnerability : CVE-2026-78678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers t...

VulnCheck KEV: CVE-2026-66066

Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are...

Linux Distros Unpatched Vulnerability : CVE-2026-78679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option...

UBUNTU-CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

Linux Distros Unpatched Vulnerability : CVE-2026-79655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By...

CVE-2021-40964

Tiny File Manager = 2.4.6 - Esecuzione Remota di Codice Autenticato 🚨 Informazioni sull'Exploit Questo è un exploit Esecuzione Remota di Codice RCE autenticato basato su Bash per Tiny File Manager versioni = 2.4.6, vulnerabile sotto CVE-2021-40964. Lo script sfrutta: Validazione debole del...

CVE-2019-20085

📂 CVE-2019-20085 – Exploit di Directory Traversal per TVT NVMS-1000 a cura di Z3R0 Autore: Z3R0 CVE: CVE-2019-20085 Bersaglio: TVT NVMS-1000 tutte le versioni note precedenti alla patch Tipo di vulnerabilità: Directory Traversal senza autenticazione Data: Inserisci la tua data di rilascio 🔍...

CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Beliebiges Datei-Lesen 🔥 Zusammenfassung der Schwachstelle Das Eventin-Plugin = 4.0.26 für WordPress enthält eine nicht authentifizierte Schwachstelle zum beliebigen Lesen von Dateien in der Funktion proxyimage. Angreifer nutzen eine unzureichende...

CVE-2022-3992

CVE-2022-3992 Cross-Site Scripting in WonderCMS Beschreibung: Eine Cross-Site-Scripting XSS-Sicherheitslücke im Sanitization Management System v1.0 ermöglicht es potenziellen Angreifern, beliebige Dateien über einen manipulierten Namen in die Systemlogo-Felder der Systeminfo-Felder hochzuladen. D...