CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Beliebiges Datei-Lesen 🔥 Zusammenfassung der Schwachstelle Das Eventin-Plugin = 4.0.26 für WordPress enthält eine nicht authentifizierte Schwachstelle zum beliebigen Lesen von Dateien in der Funktion proxyimage. Angreifer nutzen eine unzureichende...

CVE-2022-3992

CVE-2022-3992 Cross-Site Scripting in WonderCMS Beschreibung: Eine Cross-Site-Scripting XSS-Sicherheitslücke im Sanitization Management System v1.0 ermöglicht es potenziellen Angreifern, beliebige Dateien über einen manipulierten Namen in die Systemlogo-Felder der Systeminfo-Felder hochzuladen. D...

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-32559

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-32559

UltimateAI is a WordPress plugin affected by an arbitrary file upload vulnerability in versions ≤ 3.1.0 . A user with Subscriber privilege level can upload arbitrary files without user interaction, with a scope change that allows full compromise of confidentiality, integrity, and availability (CV...

CVE-2026-32559 WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in UltimateAI = 3.1.0 versions...

CVE-2026-78284

CVE-2026-78284 is an unauthenticated arbitrary file deletion vulnerability in the MasterStudy LMS WordPress plugin, affecting versions 3.7.42 and earlier . An attacker can delete files on the server without any authentication or user interaction. The CVSS 3.1 base score is 8.6 (HIGH) , driven by ...

CVE-2026-78284 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-75464

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via importlink...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile: Scrittura Arbitraria di File tramite Path Traversal CVE-2025-4517 CVSS 9.4 – Critico Una vulnerabilità nel modulo tarfile di Python che consente la scrittura arbitraria di file al di fuori della directory di estrazione quando si utilizza TarFile.extractall o...

GHSA-JM48-M3RR-9HGG 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Summary An authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray including roo...

EUVD-2026-39432

3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation...

ChamiloLMS-CVE-2023-4220

Exploit ChamiloLMS CVE-2023-4220 Exploit Python per CVE-2023-4220 , una vulnerabilità di upload arbitrario di file non autenticato che interessa Chamilo LMS = 1.11.24. La vulnerabilità si trova nel componente BigUpload di Chamilo. Sulle installazioni vulnerabili, il gestore di upload permette di...

FortiLPE

Descrizione Exploit PoC di escalation dei privilegi locale per CVE-2025-62676 / EUVD-2025-206993 che mira a FortiClient VPN in esecuzione su Windows. Esegue un payload nel contesto di SYSTEM da un contesto utente normale tramite una scrittura arbitraria di file XML. Il PoC è stato testato contro...

CVE-2025-25163

CVE-2025-25163 Plugin A/B Image Optimizer = 3.3 - Authentifizierter Abonnent+ Beliebiger Datei-Download Beschreibung Das Plugin A/B Image Optimizer für WordPress ist in allen Versionen bis einschließlich 3.3 anfällig für Directory Traversal. Dadurch können authentifizierte Angreifer mit Zugriff a...

CVE-2024-7135

CVE-2024-7135 Tainacan = 0.21.7 - प्रमाणित उपयोगकर्ताओं सब्सक्राइबर+ द्वारा आर्बिट्रेरी फ़ाइल रीड के लिए लापता प्राधिकरण विवरण WordPress के लिए Tainacan प्लगइन 0.21.7 तक के सभी संस्करणों में 'getfile' फ़ंक्शन पर क्षमता जाँच की कमी के कारण डेटा के अनधिकृत अभिगम के लिए संवेदनशील है। यह फ़ंक्शन...

Gitea-Forgejo-CVE-2025-68937

Vulnerabilità di espansione arbitraria dei template in Gitea e Forgejo Quest'opera è distribuita con licenza Creative Commons Attribution-ShareAlike 4.0 International License. Sommario Durante l'analisi del codice sorgente di Forgejo e Gitea per comprendere meglio come viene eseguito il templatin...

CVE-2026-71932

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to acce...

pwn-pulse

pwn-pulse.sh Exploit per la vulnerabilità di lettura arbitraria di file in Pulse Connect Secure SSL VPN CVE-2019-11510 Script creato da braindead @BishopFox. Basato sulla ricerca di Orange Tsai e Meh Chang. Ringraziamenti anche a Alyssa Herrera e 0xDezzy per ulteriori contributi. Un enorme grazie...

CVE-2026-77113

Traversal de Caminho no apport-unpack do Apport CVE-2026-77113 https://youtu.be/CdM1Xtnx0uQ Uma questão de traversal de caminho no apport-unpack do Apport permitia que chaves de relatório controladas pelo atacante escapassem do diretório de extração especificado. Um relatório criado contendo:...