CVE-2026-30345

CVE-2026-30345 Proof of Concept Arbitrary file write vulnerability in CTFd 3.8.2 backup import functionality. Quick Start Before running cve202630345bashrcpoc.py Make sure to update the values accordingly for your exploit. Values such as RHOST, ATTACKER IP or PORT, and the credentials used for th...

CVE-2026-35492

CVE-2026-35492 CVE-2026-35492Path traversal vulnerability in PartitionedDataset allows arbitrary file write Impact PartitionedDataset in kedro-datasets was vulnerable to path traversal. Partition IDs were concatenated directly with the dataset base path without validation. An attacker or maliciou...

CVE-2026-29780

Path Traversal in Official Example Script Leading to Arbitrary File Write Summary The official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows arbitrary file write outside the intended output directory. Attachment filenames extracted fr...

CVE-2026-5027

This post is a research article published by EQSTLab. Thanks toYahia Hamza, who reported and analyzed this vulnerability. CVE-2026-5027 ★ CVE-2026-5027 Langflow Path Traversal / Arbitrary File Write PoC ★ Description CVE-2026-5027 : Langflow Arbitrary File Write Vulnerability description: A path...

CVE-2026-25732-NiceGUI-3.6.1

Author: Mohammed Idrees Banyamer Contact: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI Path Traversal in FileUpload → Arbitrary File Write Exploit Title: NiceGUI Path Traversal in FileUpload Leading to Arbitrary File Write Date: 2025-06-06 Tested on:...

cve-2026-21440-writeup-poc

cve-2026-21440 path traversal to arbitrary file write in @adonisjs/bodyparser overview a critical path traversal vulnerability exists in the @adonisjs/bodyparser package that allows remote attackers to write arbitrary files outside the intended upload directory. when the multipartfile.move functi...

zimaos-cve-2026-28286-arbitrary-file-write

🚨 CVE-2026-28286 — ZimaOS Arbitrary File Write From API Misconfiguration → Arbitrary File Write → Potential System Compromise ⚡ TL;DR Endpoint: /v21/files/file Issue: No path validation Impact: Arbitrary file write outside the intended directory Severity: 🔴 Critical 🧪 Quick Start git clone...

CVE-2024-54910

CVE-2024-54910 https://vulners.com/cve/CVE-2024-54910 This document explores a vulnerability that allows arbitrary file writes, leading to privilege escalation on a Windows System that has Hasleo Backup Suite Free = 4.9.4 installed. It demonstrates how backup recovery operations, combined with...

CVE-2026-23907

Apache PDFBox Path Traversal Vulnerability Vulnerability Summary Description Apache PDFBox's ExtractEmbeddedFiles example code does not sanitize filenames when extracting embedded files from PDFs. An attacker can embed files with path traversal sequences ../ to write files to arbitrary filesystem...

CVE-2026-52680_exploit

CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbitrary File Write Unauthenticated arbitrary file write in Apache Kyuubi's REST API via the multipart batch-submission endpoint. POST /api/v1/batches multipart/form-data writes the resourceFile part to $KYUUBIHOME/work/upload// using the...

NotCVE-2026-0009

Path Traversal Vulnerability in nitroshare Description NitroShare Desktop v0.3.4 contains a path traversal vulnerability in its LAN file transfer server. The server listens on all network interfaces port 40818 without authentication. When receiving files, the name field from the sender's JSON ite...

helm-plugin-path-traversal-security-assessment

CVE-2026-35204 - Helm Plugin Path Traversal Arbitrary File Write Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Helm plugin path traversal risk, including technical analysis, impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

EUVD-2026-102114

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2026-57155

OPNsense versions prior to 26.1.11 and 26.4.1p1 are vulnerable to Root Remote Code Execution (RCE) via an arbitrary file write in the Firewall Alias GeoIP importer . The root cause is an unvalidated CSV country_code value in the process_zip() and process_gzip() paths of src/opnsense/scripts/filte...

CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2026-57155 OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's processzip and processgzip paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV countrycode value to construct output filenames below...

CVE-2023-37582_EXPLOIT

CVE-2023-37582EXPLOIT Apache RocketMQ Arbitrary File Write Vulnerability Exploit Demo Overview In fact, the Arbitrary file write vulnerabilityCVE-2023-37582 in Apache RocketMQ has already been addressed in the CVE-2023-33246 RCE vulnerability. However, the fix provided for CVE-2023-33246 RCE is n...

CVE-2024-3912

Why? Publishing because Mirai are a bunch of irritating twats that keep popping my honeypot with it - you're not the malware I am after. Fek off please. Here's their irritating malware distribution IP and defualt payload script. http://130.12.180.69/bins/kla.sh Description Asus router arbitrary...

CVE-2021-3007-docker-poc

CVE-2021-3007 — Laminas/Zend HTTP Deserialization RCE This repository contains a fully reproducible Proof-of-Concept and Nuclei exploit template for CVE-2021-3007, a critical PHP deserialization vulnerability in Zend\Http\Response\Stream laminas-http Nuclei exploit template ├── docker-compose.yml...

CVE-2021-32804

CVE-2021-32804 This is a repository for building the Docker environment used in the yamory blog "CVE-2021-32804 Path Traversal Vulnerability in node-tar Affecting npm". Environment Setup docker build -t cve-2021-32804 . docker run -it cve-2021-32804 /bin/bash Vulnerability Reproduction node-tar...