EUVD-2026-65501

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

CVE-2026-55530 PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

CVE-2026-55530 PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

AZL-98211 CVE-2026-79655 affecting package sos 4.6.1-2

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2022-29464

WSO2 RCE CVE-2022-29464 exploit e writeup. Dettagli CVE-2022-29464 è una grave vulnerabilità in WSO2. La vulnerabilità è un caricamento arbitrario di file non autorizzato e senza restrizioni che consente a utenti non autorizzati di caricare file JSP dannosi sui server WSO2 e ottenere l'esecuzione...

CVE-2026-79655

A path traversal flaw in the sos clean utility (part of the sos package) allows a local attacker to perform arbitrary file creation or overwrite . The root cause is improper validation of symlink and hardlink targets during tar archive extraction. A specially crafted tar archive can cause files t...

CVE-2026-79655 Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

EUVD-2026-65492

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2025-2539

POC - CVE-2025-2539 File Away Disclaimer : Questa Proof of Concept POC è realizzata solo per scopi educativi e di test etici. L'utilizzo di questo strumento per attaccare target senza previo consenso reciproco è illegale. È responsabilità dell'utente finale rispettare tutte le leggi locali, stata...

CVE-2026-12277

CVE-2026-12277 Plugin Frontend File Manager WordPress = 23.6 – Eliminazione arbitraria di file non autenticata a RCE Riepilogo...

CVE-2025-11001---7-Zip

CVE-2025-11001 - 7-Zip Symlink traversal ad alta gravità in 7-Zip che consente la scrittura arbitraria di file / RCE Corretto in 7-Zip 25.00 luglio 2025 – Exploit pubblico disponibile SOLO PER TEST DI SICUREZZA E RICERCA AUTORIZZATI -critical Riepilogo della vulnerabilità CVE : CVE-2025-11001 CVS...

Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Einfach direkt ausführen root@kitploit: python server-1.py Beliebiger Datei-Upload root@kitploit: PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 Effekt wie folgt: CVE-2021-41127 server-1.py Standard-Modellname:...

CVE-2026-35029-PoC

CVE-2026-35029 — LiteLLM /config/update Schwachstelle für unbefugten Zugriff Broken Access Control Der /config/update-Endpunkt von LiteLLM prüft die Rollenberechtigungen des Aufrufers nicht. Jeder authentifizierte Benutzer mit einem gültigen API-Key ohne Administratorrechte kann die...

CVE-2026-78566

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

CVE-2026-78562

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

cve-2022-44268

Exploit su misura per HackTheBox Pilgrimage Script Python automatico che utilizza cve-2022-44268 per aggiungere un valore di profilo con un nome file da una filelist di input in un file di input, aggiornare il caricamento dell'immagine usando un file request.req di input da Burpsuite già incluso...

CVE-2021-23394

Configurazione di riproduzione di elFinder CVE-2021-23394 Questo repository contiene una configurazione di riproduzione per CVE-2021-23394 Esecuzione arbitraria di file in elFinder utilizzando Docker. Configura quattro ambienti per confrontare le versioni vulnerabili e corrette su Apache e Nginx...

EUVD-2026-65326

The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...

EUVD-2026-65325

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...