EUVD-2024-55738

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

CVE-2024-14047 Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

CVE-2026-52832-PoC-exploit-nuclio-dashboard

CVE-2026-52832-PoC-exploit-nuclio-dashboard Nuclio Dashboard（NOP 模式）接受未经认证的 POST /api/functions 请求。spec.handler 字段未经过路径校验，因此 ../../../../tmp/x.txt:handler 可通过 path.Join 逃逸构建临时目录，使攻击者能够以 root 身份将任意内容写入任意路径。CVE-2026-52832, ≤1.15.27 CVE-2026-52832 Nuclio Dashboard 路径遍历 → 任意文件写入 通过 spec.handler...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability that allows an authenticated user with limited privileges to write attacker-controlled content to arbitrary filesystem paths. The CVSS 3.1 base score is 8.8 (HIGH) with a network attack vector and low complexity. The reference ...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

EUVD-2026-69126

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 —— TECNO Hi 浏览器下载处理器中的路径遍历漏洞 这是针对 CVE-2026-18907 （CVSS 7.5 High，CWE-23）的概念验证（PoC），该漏洞是 TECNO Hi Browser （com.talpa.hibrowser）2.23.1.1 版本下载文件功能 中的一个相对路径遍历漏洞。浏览器信任由攻击者控制的 Content-Disposition 文件名，并将其拼接到下载目录中，既未净化路径分隔符，也未对结果进行规范路径检查——因此文件名中的 ../ 序列可使响应体被写入 Download/ 目录之外、浏览器存储权限所允许的任何路...

Exch-CVE-2021-26855_Priv

Exch-CVE-2021-26855 ProxyLogon は CVE-2021-26855 の正式な総称であり、Microsoft Exchange Server の脆弱性で、攻撃者が認証をバイパスして管理者になりすますことを可能にします。このバグは、別の認証後任意ファイル書き込み脆弱性 CVE-2021-27065 とチェーンすることで、コード実行を実現しています。影響を受けるすべてのコンポーネントはデフォルトで脆弱です！ その結果、認証されていない攻撃者は、開かれている 443 ポートのみを介して Microsoft Exchange Server 上で任意のコマンドを実行できま...

cve-2025-65099

CVE-2025-65099 の概念実証 詳細は公開記事をご参照ください。 yarnPath テクニック yarnPath 用の脆弱な環境は以下のように初期化できます。 root@kitploit: docker run --rm -v "$PWD":/poc -it --workdir /poc ubuntu bash -c 'apt-get update -qq && DEBIANFRONTEND=noninteractive apt-get install npm -y -qq && npm install -g yarn && npm install -g...

CVE-2024-3912

¿Por qué? Lo publico porque Mirai es un grupo de gilipollas irritantes que no dejan de atacar mi honeypot con esto: no son el malware que estoy buscando. Lárguense, por favor. Aquí están su irritante IP de distribución de malware y su script de payload predeterminado...

SysmonEoP

SysmonEoP Sysmon 中任意文件删除/写入的概念验证（CVE-2022-41120/CVE-2022-44704） 漏洞 漏洞位于负责 ClipboardChange 事件的代码中，该事件可通过 RPC 触达。 本地用户可以向 RPC 服务器发送数据，这些数据随后会被写入 C:\Sysmon 目录（默认的 ArchiveDirectory），并在之后被删除。 在 14.11 之前的版本中，Sysmon 不会检查该目录是否由低权限用户创建，或者是否是一个 junction（联接点），这可能在 NT AUTHORITY\SYSTEM...

CVE-2022-24990

CVE-2022-24990 CVE-2022-24990信息泄露+RCE 一条龙 该poc会往目标写入文件，这里写入的是phpinfo，若需要其他功能，请自己修改，请勿用作违法用途...

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26

CVE-2024-25641-RCE-Automated-Exploit-Cacti-1.2.26 CVE-2024-25641 的完全自动化利用工具。 当用户通过身份验证后，Cacti 1.2.26 容易受到任意文件写入漏洞的影响，该漏洞可通过“包导入”（Package Import）功能加以利用，允许拥有“导入模板”（Import Templates）权限的已认证用户在 Web 服务器上执行任意 PHP 代码（RCE）。 致谢此 PoC : https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88...

CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...

CVE-2026-82393

pnpm prior to 10.34.5 and 11.11.0 is vulnerable to a scoped path traversal in a tarball dependency's package.json manifest name. The root cause is in pickPackage.ts (npm-resolver), which rejects slash characters only for unscoped names, allowing a crafted scoped name to reach raw path joins in re...

CVE-2026-59310

CVE-2026-59310 More root@kitploit: echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 root@kitploit: GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...

CVE-2023-45878

Gibbon CMS CVE-2023-45878 エクスプロイト このPythonスクリプトは、Gibbon CMS バージョン25.0.1以前における未認証の任意ファイルアップロード脆弱性 CVE-2023-45878 を悪用し、リモートコード実行（RCE）に至ります。 脆弱性の説明 CVE-2023-45878 は Gibbon CMS の rubricsvisualisesaveAjax.php エンドポイントに存在します。このエンドポイントは認証を必要とせず、任意のファイル書き込みが可能であるため脆弱です。 脆弱性は以下の点から生じます： 未認証アクセス:...

CVE-2026-79743

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...