Mitel-MiCollab-Auth-Bypass_CVE-2024-41713

CVE-2024-41713 Mitel MiCollab Authentication Bypass to Arbitrary File Read See our blog post for technical details / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y | | \ / | | / // || \ ||| | \ / // || / / / watchtowr-vs-MiCollab2024-12-05.py Mitel MiCollab Authentication...

CVE-2026-104801

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

CVE-2026-104801 PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

EUVD-2026-96218

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the renamefiles function in all versions up to, and including, 34.0.10 This makes it possible for unauthenticated attackers to delete...

CVE-2026-104801

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file deletion in all versions up to and including 34.0.10 . The root cause is insufficient file path validation within the rename_files function, specifically triggered via th...

CVE-2026-97348 SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...

CVE-2026-97348

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.74.3 . The flaw exists in the get_instance_css function, where the [siteorigin_widget] shortcode handler directly calls $the_widget-&gt;widget() on attacker-supplied decod...

CVE-2026-104763

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-104763 Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-104763

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.17.1 . An authenticated attacker with administrator-level access can perform an arbitrary file read by exploiting the file_path parameter within a media_metadata.json ...

PoC-CVE-2025-12097

CVE-2025-12097 Description NI modification of Appweb server contains a directory traversal vulnerability that allows an attacker to read arbitrary files on the server. URI path /.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/windows/win.ini will be converted to: pathInfo cchar...

CVE-2015-5531-POC

CVE-2015-5531-POC Vulnerability Background Elasticsearch is an open-source, distributed RESTful search engine built on Lucene, developed by Elasticsearch B.V. in the Netherlands. It is primarily used in cloud computing and supports indexing data via HTTP using JSON. Versions of Elasticsearch prio...

Jenkins-CVE-2024-23897

Jenkins CVE-2024-23897 PoC A proof-of-concept PoC for CVE-2024-23897, an arbitrary file read vulnerability in Jenkins' built-in command line interface CLI. It allows unauthenticated attackers with Overall/Read permission to read arbitrary files on the Jenkins controller file system. Affected...

Hoverfly < 1.10.3 - Arbitrary File Read

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The /api/v2/simulation POST handler allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read arbitrary...

Cleo Harmony < 5.8.0.21 - Arbitary File Read

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution. id: CVE-2024-50623 info: name: Cleo Harmony 5.8.0.21 - Arbitary File Read author: DhiyaneshDK severity: high...

CVE-2021-26085

CVE-2021-26085 Atlassian Confluence Server 7.5.1 Pre-Authorization Arbitrary File Read vulnerability POC Vulnerable Endpoints: WEB-INF/web.xml WEB-INF/decorators.xml WEB-INF/classes/seraph-config.xml META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties...

PT-2026-109552

Name of the Vulnerable Software and Affected Versions PPOM – Product Addons & Custom Fields for WooCommerce versions prior to 34.0.11 Description Insufficient file path validation in the rename files function allows unauthenticated attackers to delete arbitrary files on the server. This action ca...

PT-2026-109616

Name of the Vulnerable Software and Affected Versions Divi Plus versions prior to 2.4.1 Description The Divi Plus plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server. This occurs because the permission callback function SVGAnimatorController::index permissi...

CVE-2019-17662

CVE-2019-17662 Python implementation of CVE-2019-17662 TinyVNC Arbitrary File Read leading to Authentication Bypass Exploit Based on the original EDB PoC by Nikhith Tumamlapalli EDB ID: 47519 Original PoC exploit does not work due to path normalisation in the Python Requests library. The code in...

CVE-2018-20463

CVE-2018-20463 There is a security vulnerability in WordPress JSmol2WP Plugin version 1.07. Attackers can exploit this vulnerability to read arbitrary files. Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file...