49737 matches found
CVE-2021-43008-AdminerRead
CVE-2021-43008 - AdminerRead Exploit tool for Adminer 1.0 up to 4.6.2 Arbitrary File Read vulnerability Installation root@kitploit: git clone https://github.com/p0dalirius/AdminerRead cd AdminerRead sudo python3 setup.py install Usage Vulnerable versions...
CVE-2023-26262
Sitecore 10.3 Authenticated file upload vulnerability Author: Thomas Stern Date: 26/01-2023 Summary It is possible via the import languages functionality to upload and arbitrary file. This file could be a webshell that would allow for execution of code on the server. Step to reproduce For testing...
CVE-2025-23968
AI Bud ā AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o The AI Bud plugin exposes a REST API endpoint /wp-json/ai-buddy/v1/wp/attachments that allows uploading files to the WordPress media library. The endpointās file logic contains file renaming functionality that triggers after file...
CVE-2024-21545-PoC
CVE-2024-21545-PoC Proxmox VE Arbitrary File Read - Full System Compromise . Not Testeted yet... will test them this week...
CVE-2025-65346
CVE-2025-65346 ā Authenticated Path Traversal From UnZip Function Leading to Arbitrary File Write in laravel-file-manager v3.3.1 š§ Overview A Path Traversal vulnerability in the unzip/extract functionality of the affected application allows an attacker to write files to arbitrary filesystem...
CVE-2020-23591
CVE-2020-23591 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Found vulnerability in the "OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OPV3.3.1-191028" which allows an attacker to upload arbitrary file through "...
CVE-2021-21402
CVE-2021-21402 CVE-2021-21402 Jellyfin arbitrary file read Wker script, batchable. The logic is very simple, it checks for the existence of win.ini via GET: root@kitploit: define payload = /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ define info = CVE-2021-21402...
CVE-2025-68705
CVE-2025-68705 - RustFS Path Traversal Exploit Description This script exploits a path traversal vulnerability CVE-2025-68705 in RustFS that allows reading arbitrary files on the server. Requirements Python 3.6+ See requirements.txt for dependencies Installation root@kitploit: git clone...
CVE-2024-24919
Mass Auto Scanner for CVE-2024-24919 This script is designed to scan a list of URLs for the CVE-2024-24919 vulnerability on remote Check Point firewalls. It attempts to exploit the vulnerability by sending a malicious POST request to extract specified files from the target servers. Running the...
CVE-2023-29386
CVE-2023-29386 ā Manager for Icomoon This README documents a disclosed vulnerability for educational and defensive use only. Donot run tests against production systems or systems you do not own or have explicit permission to test. Discovered by: deokhunKim Status: Public Disclosure Date Reported:...
CVE-2025-46822
CVE-2025-46822 Unauthenticated Arbitrary File Read via Absolute Path Description: While Path.resolve method is being used to protect against path traversal I have found that the usage of absolute path successfully read internal files , the endpoint is also not authenticated this means anyone can...
CVE-2025-5058
eMagicOne Store Manager for WooCommerce Warning: Trying to access array offset on false in /home/vagrant/research/Lab1/wp-content/plugins/store-manager-connector/classes/class-emosmcwoocommerceoverrider.php on line 324 Warning: Trying to access array offset on false in /home/vagrant/research/...
CVE-2023-20178
CVE-2023-20178 This is PoC for Arbitrary File Delete vulnerability in Cisco Secure Client tested on 5.0.01242 and Cisco AnyConnect tested on 4.10.06079. When a user connect to vpn, vpndownloader.exe process is started in background and it will create directory in c:\windows\temp with default...
CVE-2026-88288
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...
ImageMagick-lfi-poc
ImageMagick-lfi-poc ImageMagick Arbitrary Read Files - CVE-2022-44268 also used in htb pilgrimage ImageMagick LFI PoC CVE-2022-44268 The researchers at MetabaseQ discovered CVE-2022-44268, i.e. ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image e.g., for...
CVE-2019-19576
class.upload.php = 2.0.3 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verot.net Affected product - class.upload.php = 2.0.3 Tested on newly installed Ubuntu 19.10 with PHP7.3 and Apache/2.4.38 Specifically Debian/Ubuntu has been found to be vulnerable since they add the php,...
CVE-2026-1555
CVE-2026-1555 WebStack = 1.2024 - Unauthenticated Arbitrary File Upload š¤ By: Nxploited š Nxploited ZeroDay Hub ā t.me/KNxploited š CVE-2026-1555 ā WebStack WordPress Arbitrary File Upload Unauthenticated Remote Code Execution viaimgupload AJAX handler...
CVE-2021-43798
CVE-2021-43798 Grafana-Arbitrary-File-Read 8.0.0 8.3.0 A vulnerability in Grafana CVE-2021-43798 versions 8.0.0 8.3.0 that allows an unauthenticated attacker to read arbitrary files from the server by leveraging a path traversal aimed towards the /public/plugins/ path to access sensitive files on...
CVE-2020-1938-Exploitation
CVE-2020-1938 Exploitation Apache Tomcat arbitrary JSP upload leading to RCE Description CVE-2020-1938 is a critical vulnerability which impacts Apache Tomcat from 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 ā ļø This was exploited in a Hack The Box lab. š Reference: NIST NVD Entry...
ATutor-2.2.4-Language-Exploit
ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Exploit Title: ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Date: 5/24/19 Exploit Author: liquidsky JMcPeters Vendor Homepage: https://atutor.github.io/ Software Link: https://sourceforge.net/projects/atutor/files/latest/download...