CVE-2026-86751

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in checkout acceptance note fields. The unsanitized syntax survives HTML escaping, is expanded by the CommonMark parser, and is resolved by laravel-mail-auto-embed via file_get_contents or curl. This allows authenticated users...

CVE-2026-86741

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML tags pointing to local files or remote URLs, which the mail auto-embed library r...

CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

CVE-2026-86741 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

CVE-2025-8110

CVE-2025-8110 - Bypass de symlink en Gogs - escritura arbitraria de archivos como el usuario del proceso Gogs Gogs //contents/. Gogs sigue el symlink y escribe bytes controlados por el atacante en el destino del enlace con los privilegios del proceso Gogs. Cuando Gogs se ejecuta como root, esto e...

WordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter vulnerability

Unauthenticated Arbitrary File Upload via 'type' Parameter vulnerability discovered by Adam Rayyan Aryasatya in WordPress Plugin Drag and Drop File Upload for Elementor Forms versions = 1.6.0...

CVE-2026-21858

CVE-2026-21858 + CVE-2025-68613 - Cadena completa n8n Lectura arbitraria de archivos sin autenticación → Forja de token de administrador → Evasión de sandbox → RCE | ---|--- CVE| CVE-2026-21858 AFR + CVE-2025-68613 RCE CVSS| 10.0 + 9.9 Crítico Afectado| = 0.211.0 RCE Corregido| 1.121.0 AFR /...

CVE-2026-23745

CVE-2026-23745: Sobrescritura Arbitraria de Archivos en node-tar Investigación: Joshua van Rijswijk Descripción PoC para CVE-2026-23745 , una vulnerabilidad de traversal de rutas de alta severidad en node-tar 7.5.2. La librería no sanitiza rutas absolutas en el campo linkpath para Hardlinks y...

CVE-2026-21436

CVE-2026-21436 eopkg = 4.3.4, el gestor de paquetes de Solus OS, escribe directamente en el directorio especificado los archivos que contienen rutas absolutas dentro del contenido del paquete durante la instalación de paquetes con extensión .eopkg. Incluso si se utiliza el parámetro --destdir,...

helm-plugin-path-traversal-security-assessment

CVE-2026-35204 - Escritura Arbitraria de Archivos por Path Traversal en Plugin de Helm Informe de Ciberseguridad Estilo Consultor Informe profesional de evaluación de vulnerabilidades para el riesgo de path traversal en plugins de Helm, que incluye análisis técnico, impacto, remediación y...

CVE-2024-10586-Poc

Información de Vulnerabilidad Descripción El plugin Debug Tool para WordPress es vulnerable a la creación arbitraria de archivos debido a una falta de comprobación de capacidades en la función dbtpullimage y a la ausencia de validación del tipo de archivo en todas las versiones hasta la 2.2...

CVE-2026-87818

A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files on the system by manipulating the --no-index option in the diff API. By combining this with other options, an attacker can repeatedly query local files to extract sensitive information, such as single-lin...

CVE-2026-78678

A flaw was found in GitPython. An incomplete denylist in the unsafegitrevisionoptions guard omits --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the Repo.blame function. This can lead to information disclosure, as attackers can supply revisi...

CVE-2026-87818

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

CVE-2026-25732-NiceGUI-3.6.1

Autor: Mohammed Idrees Banyamer Contacto: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — Path Traversal en NiceGUI en FileUpload → Escritura Arbitraria de Archivos Título del Exploit: Path Traversal en NiceGUI en FileUpload que Conduce a Escritura Arbitraria de...

CVE-2026-35204

CVE-2026-35204 此仓库代表 CVE-2026-35204 的概念验证 PoC。 描述 "Helm 是 Kubernetes 的 Charts 包管理器。从 4.0.0 到 4.1.3 版本，一个特制的 Helm 插件在安装或更新时，会使得 Helm 将插件内容写入任意文件系统位置。为了防止此问题，需要验证 Helm 插件的 plugin.yaml 中 version: 字段是否包含 POSIX 点-点路径分隔符，即 "/../"。此漏洞已在 4.1.4 版本中修复。" 此 PoC 演示了 metadata.Version 被用于构造插件归档的路径，从而允许路径穿越，并将下载...

CVE-2024-9290

CVE-2024-9290 Super Backup & Clone - Migrate for WordPress = 2.3.3 - 未授权任意文件上传 描述 Super Backup & Clone - Migrate for WordPress 插件的 WordPress 版本存在任意文件上传漏洞，原因是 ibkrestoremigratecheck 函数缺少文件类型验证和权限检查，影响所有版本及 2.3.3 版本。这使得未授权攻击者可以在受影响站点的服务器上上传任意文件，可能导致远程代码执行。 详情 类型 : 插件 Slug : indeed-wp-superbackup...

CVE-2021-23394

elFinder CVE-2021-23394 复现环境搭建 本仓库包含一个使用 Docker 对 CVE-2021-23394 （elFinder 任意文件执行漏洞）的复现环境。它设置了四个环境，用于对比漏洞版本与修复版本在 Apache 和 Nginx 下的表现。 概述 本环境包含： 1. Apache 漏洞版本 （端口 8080）：elFinder 2.1.57 在 Apache 上运行 2. Apache 修复版本 （端口 8081）：elFinder 2.1.66 在 Apache 上运行 3. Nginx 漏洞版本 （端口 8082）：elFinder 2.1.57 在...

CVE-2024-7514

CVE-2024-7514 WordPress Comments Import & Export = 2.3.7 - 已验证（作者以上权限）通过目录遍历实现任意文件读取 描述 WordPress 的 Comments Import & Export 插件在评论导入过程中，因文件路径验证不足，导致存在任意文件读取漏洞，影响版本至 2.3.7（含）。这使得经过身份验证的攻击者（拥有作者及以上权限）能够读取任意文件内容 Info root@kitploit: Type: plugin CVSS Score: 6.5 CVE: CVE-2024-7514 Link:...

CVE-2024-52380

CVE-2024-52380 Picsmize -----------------------------263629263440545280502417734995 Content-Disposition: form-data; name="action" PicsUploadManualFile -----------------------------263629263440545280502417734995--...