49814 matches found
EUVD-2026-75580
knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...
CVE-2026-88937
knowns through version 0.33.0 is affected by a path traversal vulnerability in its code generation template engine (internal/codegen/template_engine.go). The engine fails to properly validate template destination paths, allowing an attacker who supplies a malicious template to read and write arbi...
security-research
安全研究 与我的个人安全研究相关的文件集合。更多内容将发布在我的博客 https://blog.mirch.io 上。 工具 工具| 描述 ---|--- openssldircheck| 用于检查 OpenSSL 库中 OPENSSLDIR 构建参数可能使用的不安全路径的 Windows 实用程序 ssscache2john| 将 SSSD LDAP 缓存文件转换为 John The Ripper 格式 DumpTompcatSessions| 使用 JMX 转储 Tomcat 会话 漏洞 CVE-2025-32463 - Sudo...
CVE-2026-66066
CVE-2026-66066 — KindaRails2Shell Ruby on Rails Active Storage + libvips 任意文件读取 → 条件性远程代码执行RCEPoC 工具。 单文件,Python 3.11+ 纯标准库零依赖 ,内置 MAT/HDF5 混合载荷、纯 Python PNG 像素解码器、偏移读取、密钥恢复、RCE 与扫描模式。 漏洞简述 Rails 信任客户端自报的 contenttype直接上传端点,libvips 则嗅探文件 magic bytes——同一个文件在两层被当成两种格式 。攻击者构造"前 10 字节文本声称 MATLAB 5.0、字...
CVE-2026-81789
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...
CVE-2026-81275
Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...
CVE-2025-10041
CVE-2025-10041 Flex QR Code Generator = 1.2.5 - Unauthenticated Arbitrary File Upload 🚨 Flex QR Code Generator ≤ 1.2.5 - Unauthenticated Arbitrary File Upload 📝 Description The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation ...
CVE-2026-81789 WordPress Advanced Product Fields Extended for WooCommerce plugin <= 3.1.6 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce allows Path Traversal. This issue affects Advanced Product Fields Extended for WooCommerce: from n/a through 3.1.6...
CVE-2026-81789
Advanced Product Fields Extended for WooCommerce WordPress plugin, versions ≤ 3.1.6 , is affected by an unauthenticated arbitrary file deletion vulnerability. The CVSS 3.1 score is 8.6 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, indicating a network-exploitable issue requiring no...
EUVD-2026-75522
Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce = 3.1.6 versions...
CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability
Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...
CVE-2026-81275
The WordPress Youzify plugin (versions
EUVD-2026-75514
Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...
CVE-2026-52680_exploit
CVE-2026-52680 — Apache Kyuubi REST 批处理路径遍历任意文件写入 在 Apache Kyuubi 的 REST API 中，通过 multipart 批量提交端点 可实现未经认证的任意文件写入。 POST /api/v1/batches（multipart/form-data）会将 resourceFile 部分写入 $KYUUBIHOME/work/upload//，使用的是客户端提供的文件名 ，且没有 路径遍历检查（kyuubi-common 的 Utils.writeToTempFile）： root@kitploit: val filePath ...
github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution
A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...
WordPress AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter vulnerability
WordPress AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin = 11.0.4 - Unauthenticated Arbitrary File Read via 'username' Parameter vulnerability discovered by daroo in WordPress Plugin AcyMailing SMTP Newsletter versions = 11.0.4...
ktor-xxe-poc
CVE-2023-45612: Prueba de concepto de XXE en JetBrains Ktor Este repositorio contiene un servidor Ktor vulnerable para demostrar la vulnerabilidad de inyección de entidad externa XML XXE identificada en CVE-2023-45612. La vulnerabilidad existe en versiones de Ktor anteriores a 2.3.5 cuando el...
CVE-2021-3007-docker-poc
CVE-2021-3007 — RCE por deserialización HTTP en Laminas/Zend Este repositorio contiene una prueba de concepto totalmente reproducible y una plantilla de exploit de Nuclei para CVE-2021-3007, una vulnerabilidad crítica de deserialización de PHP en Zend\Http\Response\Stream laminas-http plantilla d...
CVE-2026-84828
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...